Examkin

Security Operations

627 questions

All types627Multiple choice320Multiple select139Matching36Ordering132
Question 161Question →

A Security Operations Center (SOC) team is organizing its Security Information and Event Management (SIEM) data pipeline. Match each SIEM data processing phase on the left with its primary operational function on the right.

Click a left item, then click its matching right item

Items

Parsing
Normalization
Aggregation
Correlation

Matches

Show answer & explanation

Answer

Parsing corresponds to extracting structured key-value pairs from raw log strings. Normalization corresponds to mapping disparate log field names to a common standard schema. Aggregation corresponds to consolidating duplicate log events. Correlation corresponds to analyzing relationships among events across diverse log sources over time.
Each SIEM processing phase has a distinct function: Parsing extracts key-value pairs from raw log text; Normalization maps extracted fields to a common taxonomy; Aggregation deduplicates log events to save storage; and Correlation analyzes logic across multiple sources to identify complex security incidents.

Step-by-Step Solution

1
Identify the primary purpose of log parsing.
Parsing interprets raw log syntax to extract discrete data fields.
Raw logs arrive as unstructured text and must be broken into usable fields.
2
Identify the primary purpose of log normalization.
Normalization aligns field names across different vendors into a unified schema.
Different devices name fields differently (e.g., src_ip vs client_ip).
3
Identify the primary purpose of log aggregation.
Aggregation combines repeating identical log entries into summary records.
High-volume logging can quickly deplete storage if duplicates are not consolidated.
4
Identify the primary purpose of event correlation.
Correlation evaluates multi-source log rules over time windows.
Detecting complex attacks requires evaluating sequences of events across multiple hosts.

Key Concept

SIEM Log Ingestion and Processing Pipeline
Question 162Question →

A Security Operations Center (SOC) analyst detects anomalous activities in an enterprise cloud environment. An unknown adversary compromised a privileged user account via session hijacking and registered a malicious OAuth application to maintain persistent access. The attacker is currently executing automated API requests to enumerate and exfiltrate sensitive cloud storage buckets. According to NIST incident response guidelines, which of the following actions should the analyst execute during the CONTAINMENT phase to restrict the threat while preserving forensic evidence? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Revoke all active OAuth refresh tokens and session keys associated with the compromised user account and malicious application.; Apply an inline access control rule or Conditional Access policy to block requests originating from the adversary's command-and-control (C2) IP ranges.

Answer

The correct containment actions are revoking active OAuth tokens/sessions and applying conditional access rules to block the adversary's C2 IP addresses.
During the containment phase, the primary objective is to limit the scope of an incident and stop active adversary operations while maintaining forensic integrity. Revoking active OAuth refresh tokens/session keys cuts off API access immediately, while applying network filtering rules against known command-and-control IP addresses stops data exfiltration without modifying forensic artifacts.

Step-by-Step Solution

1
Analyze the incident phase requirements based on NIST SP 800-61 Rev. 2 framework.
The current task requires identifying actions specific to Containment, which isolates affected resources and prevents further damage without destroying forensic evidence.
Containment must precede eradication and recovery to stop ongoing threat activity while retaining environment state for analysis.
2
Evaluate token revocation and conditional access policy enforcement.
Revoking OAuth sessions immediately stops API access, and blocking C2 IP ranges prevents network communication.
Both steps contain the adversary's active access vectors cleanly without tampering with historic security logs or tenant artifacts.
3
Evaluate the incorrect options regarding evidence destruction and phase ordering.
Deleting identity stores or clearing audit logs disrupts forensic investigation and jumps out of sequence into eradication/recovery.
Log deletion destroys digital evidence and tenant redeployment is a recovery phase operation.

Key Concept

Incident Response Containment Phase Strategies and Evidence Preservation
Question 163Question →

During off-hours monitoring, a Security Operations Center (SOC) analyst detects an unauthorized PowerShell script executing on an internal domain-joined workstation. EDR telemetry confirms the script is actively performing Kerberoasting by requesting Service Principal Name (SPN) tickets with weak RC4 encryption across the internal subnet to prepare for offline password cracking. According to standard incident response lifecycle frameworks, which of the following actions should the analyst perform FIRST?

Show answer & explanation

Answer: Isolate the compromised workstation from the network using host-level isolation controls.

Answer

Isolate the compromised workstation from the network using host-level isolation controls.
In standard incident response frameworks (such as NIST SP 800-61), once an active threat is detected on a system, the immediate priority is Containment. Disconnecting or isolating the compromised endpoint from the network stops the ongoing Kerberoasting attack from reaching other Domain Controllers or pivoting laterally across the internal subnet, while keeping the machine powered on for volatile memory capture.

Step-by-Step Solution

1
Analyze the incident lifecycle stage based on the SOC telemetry.
The incident is currently in the active execution/containment phase where an internal endpoint is performing unauthorized credential harvesting.
Before performing remediation or forensic cleanup, active spread and communication must be halted.
2
Determine the mandatory initial response phase per NIST SP 800-61 incident response guidelines.
Containment must take precedence over eradication and recovery.
Failing to contain the active host allows the attacker to continue harvesting tickets or pivot deeper into the enterprise network.
3
Select the action that achieves effective host containment without destroying immediate evidence or jumping to eradication.
Endpoint network isolation prevents lateral movement while allowing volatile memory to remain intact for investigation.
Host-level EDR isolation disconnects network interfaces while keeping the machine running for live memory forensics.

Key Concept

Incident Response Containment Phase Prioritization
Question 164Question →

In Security Information and Event Management (SIEM) workflow, log data undergoes several processing stages from initial ingestion to analyst notification. Which sequence correctly places the stages of SIEM log processing in chronological order from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of SIEM log processing stages is Log Collection, Log Parsing, Log Normalization, Event Correlation, and Alerting.
The standard SIEM data ingestion and processing flow follows five sequential steps: first, raw data is gathered (Log Collection); second, raw log strings are split into field elements (Log Parsing); third, parsed fields are mapped into common standard formats across all vendor logs (Log Normalization); fourth, normalized events are evaluated across time and sources against security correlation rules (Event Correlation); and finally, confirmed security incidents generate notifications for security analysts (Alerting).

Step-by-Step Solution

1
Identify the initial ingestion phase
Log Collection is identified as the mandatory first step to gather raw data from sources.
Data cannot be processed until it is ingested by the collector or agent.
2
Determine data structure and standard format conversion
Log Parsing occurs prior to Log Normalization.
Raw unstructured logs must first be parsed into individual key-value fields before those fields can be mapped to a standardized taxonomy.
3
Identify analytical logic execution and final output
Event Correlation runs on normalized logs, followed by Alerting as the final output.
Correlation rules require standardized fields across different logs to evaluate patterns, and alerts are only generated after correlation triggers a rule match.

Key Concept

SIEM Log Processing Pipeline
Question 165Question →

A security operations team identifies active network exfiltration originating from a compromised, ephemeral container running on a live enterprise Linux host. Enterprise auto-scaling rules are triggered, which will automatically terminate and delete the container instance within minutes. To preserve forensic evidence for legal proceedings while strictly adhering to the order of volatility, which of the following actions should the incident responder take FIRST?

Show answer & explanation

Answer: Acquire the live RAM dump of the host and container execution memory before shutting down or imaging persistent storage volumes.

Answer

Acquiring the live RAM dump of the host and container execution memory before shutting down or imaging persistent storage volumes.
The correct response recognizes that volatile memory (system RAM, process memory, kernel structures) must be captured first according to the standard forensic Order of Volatility (CPU registers/cache -> RAM -> Swap -> Disk -> Remote logs -> Archival media). Because the container instance is ephemeral and actively running, stopping or imaging storage first will irrevocably destroy critical runtime evidence held only in RAM.

Step-by-Step Solution

1
Assess the order of volatility for digital evidence.
Identify that volatile memory (RAM, CPU cache, active network connections) disappears immediately upon system state changes or host shutdown.
RAM is higher on the volatility hierarchy than persistent disk storage or archival backups.
2
Prioritize memory capture over persistent disk imaging.
Capture live host RAM and container execution state memory prior to taking storage snapshots or issuing process management commands.
Ephemeral containers lose all runtime memory and state artifacts permanently once terminated.
3
Calculate cryptographic hashes of acquired memory and storage artifacts.
Ensure integrity verification and chain of custody documentation for all collected forensic artifacts.
Maintaining verifiable cryptographic hashes guarantees evidence integrity in legal proceedings.

Key Concept

Order of Volatility in Digital Forensics
Question 166Question →

A Security Operations Center (SOC) analyst is investigating an automated SIEM alert triggered during incident response telemetry collection. The analyst reviews the following correlated chronological log snippet collected from an internal host (`host-app01`), a perimeter Web Application Firewall (`WAF-EDGE01`), and a backend database server (`db-prod01`):

[2026-07-27T14:10:02Z] host-app01 sshd[14201]: Failed password for root from 10.0.4.88 port 49152 ssh2
[2026-07-27T14:10:04Z] host-app01 sshd[14205]: Accepted password for svc_deploy from 10.0.4.88 port 49154 ssh2
[2026-07-27T14:12:30Z] WAF-EDGE01 action="ALERT_ONLY" src="10.0.4.88" uri="/db_admin.php?user=admin' OR '1'='1" signature="SQLi_Generic_Clause"
[2026-07-27T14:13:01Z] db-prod01 mariadb[882]: [Access Granted] User 'svc_deploy'@'10.0.4.88' executed query: "SELECT * FROM customer_pii;"

Based on the log telemetry above, which of the following security findings and incident conclusions are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The threat actor gained access by authenticating with valid service account credentials following a failed attempt to log in as root.; The compromised account was used to execute direct queries retrieving sensitive customer personally identifiable information (PII) from the database daemon.

Answer

The correct findings are: (1) The threat actor gained access by authenticating with valid service account credentials following a failed root login attempt, and (2) The compromised account was used to execute direct queries retrieving sensitive customer PII from the database.
Correlating timestamps and IP address 10.0.4.88 across all three system logs demonstrates that an attacker attempted to log in as root, successfully authenticated as 'svc_deploy', launched SQL injection probes against the web application, and executed SQL queries extracting customer PII directly from the database.

Step-by-Step Solution

1
Analyze host authentication telemetry
Identified a failed root login attempt followed by a successful login for 'svc_deploy' from source IP 10.0.4.88.
Establishing initial access vector and credential usage from host log entries.
2
Analyze WAF security alert log
Identified a SQL injection payload (' OR '1'='1) originating from the same source IP 10.0.4.88.
Determining web-layer attack vectors and distinguishing SQL injection signatures from other web application attack types.
3
Correlate database audit log with host credentials
Confirmed that the compromised service account 'svc_deploy' issued queries exfiltrating customer PII data.
Mapping sequential actions across multiple log sources to establish impact and scope of compromise.

Key Concept

Cross-device log correlation and attack vector identification within SIEM analysis
Question 167Question →

A Security Operations Center (SOC) analyst is investigating a high-priority alert in a SIEM platform. The following log snippet was captured from a Linux server's authentication system:

Jul 27 14:02:11 host01 sshd[14201]: Failed password for invalid user admin from 198.51.100.45 port 49152 ssh2
Jul 27 14:02:13 host01 sshd[14205]: Failed password for invalid user root from 198.51.100.45 port 49154 ssh2
Jul 27 14:02:15 host01 sshd[14209]: Failed password for valid user jsmith from 198.51.100.45 port 49156 ssh2
Jul 27 14:02:18 host01 sshd[14212]: Accepted password for valid user jsmith from 198.51.100.45 port 49160 ssh2
Jul 27 14:02:22 host01 sudo: jsmith : TTY=pts/1 ; PWD=/home/jsmith ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow

Based on the log sequence provided, which of the following best describes the nature of the security incident?

Show answer & explanation

Answer: An external entity performed a brute-force authentication attack, compromised a valid user account, and subsequently attempted privilege escalation to access system password hashes.

Answer

An external entity performed a brute-force authentication attack, compromised a valid user account, and subsequently attempted privilege escalation to access system password hashes.
The sequence of log entries shows sequential password attempt failures from a single external IP address within seconds, followed by a successful SSH authentication for user 'jsmith'. Immediately after authenticating, the compromised session issued a sudo command to inspect /etc/shadow, which stores encrypted system password hashes. Correlating these events proves a successful brute-force compromise followed by privileged file access.

Step-by-Step Solution

1
Analyze the initial authentication log entries
Multiple rapid SSH failure messages ('Failed password') are generated from IP address 198.51.100.45 targeting various account names ('admin', 'root', 'jsmith').
This behavior indicates automated password guessing or a brute-force authentication attack.
2
Analyze the successful authentication entry
At 14:02:18, an 'Accepted password' entry appears for user 'jsmith' from the exact same source IP (198.51.100.45).
This confirms that the brute-force attempt succeeded in compromising legitimate user credentials.
3
Analyze the post-authentication event log
Four seconds after login, the user executes 'sudo /usr/bin/cat /etc/shadow' as root.
Accessing /etc/shadow is an attempt to exfiltrate password hashes, representing immediate post-compromise privilege escalation and credential harvesting.

Key Concept

Correlating multi-stage authentication logs and privilege escalation indicators in SIEM analysis.
Estimated Time:1m 30s
Question 168Question →

A Security Operations Center (SOC) analyst detects anomalous outbound network traffic originating from an automated CI/CD build worker node. Telemetry confirms that a compromised runner script exfiltrated temporary cloud provider authentication tokens to an external command-and-control server and is currently reading production database credentials stored in secret memory. According to the NIST incident response lifecycle guidelines (SP 800-61), which of the following actions should the analyst execute FIRST?

Show answer & explanation

Answer: Revoke the exposed access token and isolate the affected CI/CD runner host from the network.

Answer

Revoke the exposed access token and isolate the affected CI/CD runner host from the network.
According to NIST SP 800-61 incident response guidelines, once an active incident is detected, the analyst's immediate priority is Containment. Revoking active compromised credentials and network-isolating the runner host prevents ongoing exfiltration and lateral movement.

Step-by-Step Solution

1
Identify the current phase of incident response
The incident has been detected and confirmed; the response enters the Containment, Eradication, and Recovery phase, specifically starting with Containment.
Immediate containment limits the scope of damage and prevents active exfiltration.
2
Determine the prioritized containment steps
Isolating the infected node and revoking compromised tokens stops network exfiltration and invalidates stolen credentials immediately.
Credentials and network access must be neutralized before persistent access can be established elsewhere.
3
Differentiate containment actions from eradication and post-incident actions
Re-imaging (eradication), patching (corrective control), and playbook updates (post-incident lessons learned) must occur only after containment is achieved.
Executing eradication or post-incident steps prematurely leaves active vectors uncontained.

Key Concept

Incident Response Lifecycle Phase Ordering and Containment Strategies
Question 169Question →

An incident response investigator is tasked with preserving forensic evidence from a live high-frequency trading server that was compromised during an active cyber intrusion. The server is currently powered on and running critical processes in memory. To ensure that digital evidence is collected without destroying highly transient artifact state in compliance with RFC 3227 guidelines, in what sequence should the investigator acquire the artifacts from most volatile to least volatile?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct acquisition order from most volatile to least volatile is: CPU registers and cache → System RAM and active network state → Swap files and temporary file systems → Local NVMe drives and non-volatile disk volumes → Offsite archival tape backups.
Digital evidence collection must strictly follow RFC 3227 guidelines starting with the shortest lifespan items to prevent evidence destruction. CPU registers and caches alter state in nanoseconds and are lost first, followed by volatile system memory (RAM and active network caches), swap/page files on storage drives, non-volatile local disk storage, and finally offline archival backup tapes.

Step-by-Step Solution

1
Identify the most volatile hardware components.
CPU registers, L1/L2 caches, and pipeline states are identified as changing on a nanosecond scale.
According to RFC 3227, processor-level memory is lost almost instantaneously upon state change or interruption.
2
Locate volatile volatile system memory and transient OS tables.
System RAM, ARP cache, routing tables, and process memory are placed immediately after CPU cache.
Physical RAM and active network structures cleared upon power-down represent the primary target for live memory analysis.
3
Sequence secondary dynamic disk structures.
Pagefiles, swap space, and temporary file systems are placed after physical RAM.
Swap space resides on disk but changes rapidly during system execution, persisting longer than physical RAM but changing faster than static disk files.
4
Capture static non-volatile primary storage media.
Local NVMe storage volumes and bit-stream disk images are sequenced after temporary/swap storage.
Persistent local storage retains data across reboots and power outages.
5
Place long-term offline media at the end of the sequence.
Offsite archival tape backups and optical media are established as the least volatile evidence.
Offline backup media is immutable and disconnected from active host execution.

Key Concept

RFC 3227 Order of Volatility
Question 170Question →

During operational security monitoring, a SOC analyst receives an automated alert indicating that an administrative workstation has established unauthorized command-and-control (C2) communications following the execution of a malicious macro from a spear-phishing email. According to standard incident response playbooks for initial containment and evidence preservation, which of the following immediate steps should the analyst perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Disconnect or isolate the affected workstation from the local network using host-level Endpoint Detection and Response (EDR) controls.; Capture volatile system memory (RAM) and current network state artifacts prior to powering down or rebooting the endpoint.

Answer

The analyst should isolate the host network access using EDR controls and capture volatile memory (RAM) before taking hardware offline.
Isolating the endpoint via EDR controls effectively stops lateral movement and active C2 communication while preserving the live machine state. Collecting volatile memory (RAM) ensures sensitive volatile evidence is captured prior to system modification or shutdown.

Step-by-Step Solution

1
Identify the primary objectives of the Containment phase in the Incident Response Lifecycle.
Containment limits the spread of the security breach while maintaining system state for evidence preservation.
Stopping lateral movement and C2 communications without destroying volatile evidence is required before eradication begins.
2
Evaluate containment actions against forensic preservation requirements (Order of Volatility).
Isolating the network interface stops C2 traffic; dumping RAM captures volatile artifacts before shutdown.
Powering off or re-imaging prematurely destroys transient memory evidence required to analyze the attack.

Key Concept

Incident Response Containment Phase and Forensic Order of Volatility
Question 171Question →

An incident responder is dispatched to preserve evidence from a powered-on corporate database server involved in an ongoing security breach. To ensure evidence integrity and adhere to forensic best practices, which of the following actions should the responder take? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Dump volatile system memory (RAM) before shutting down or powering down the system.; Calculate cryptographic hashes of all acquired disk images immediately after creation and record them in the chain of custody log.

Answer

The incident responder must dump volatile system memory (RAM) before powering off the host, and calculate cryptographic hashes of all acquired images immediately after creation to record in the chain of custody log.
Capturing RAM first respects the order of volatility, ensuring transient data like active network connections and running memory artifacts are preserved. Calculating and logging cryptographic hashes immediately establishes baseline evidence integrity for legal chain of custody requirements.

Step-by-Step Solution

1
Prioritize evidence acquisition according to the Order of Volatility.
System RAM is dumped first because it loses state when power is lost or operating system processes overwrite memory.
Capturing volatile memory preserves running processes, network connections, and decrypted artifacts stored in RAM.
2
Establish proof of data integrity.
Cryptographic hashes (such as SHA-256) are calculated for the acquired images and documented in the chain of custody log.
Comparing hash values later proves that the forensic copy remains an exact, unaltered duplicate of the original evidence.

Key Concept

Digital Forensics Evidence Preservation and Chain of Custody Verification
Question 172Question →

A Security Operations Center (SOC) analyst receives an alert showing that a user workstation is executing a suspicious PowerShell script attempting lateral movement across the network. Which of the following capabilities provided by an Endpoint Detection and Response (EDR) solution should the analyst execute immediately to contain the threat while preserving management access?

Show answer & explanation

Answer: Isolate the host from the network using the EDR console

Answer

Isolate the host from the network using the EDR console
The correct action is to isolate the host from the network using the EDR console. EDR host network isolation instantly restricts network communication to and from the infected endpoint, cutting off lateral propagation paths while maintaining administrative connection to the EDR agent for forensic collection and containment.

Step-by-Step Solution

1
Identify the primary operational requirement in an active containment scenario
The goal is to immediately halt lateral movement across the internal network.
Preventing the compromise of additional host systems is the top priority during incident response.
2
Evaluate EDR endpoint control features against traditional perimeter or antivirus controls
EDR host isolation disconnects host-to-host and host-to-internet network traffic while keeping agent telemetry operational.
Isolation stops internal attack propagation without shutting down the endpoint or severing management connectivity.

Key Concept

Endpoint Containment and Host Isolation in EDR
Estimated Time:45s
Question 173Question →

Following the detection and initial triage of an active web shell exploit on an enterprise web server, a Security Operations Center (SOC) analyst must execute the incident response playbook. Arrange the following operational response procedures in the correct chronological sequence according to standard NIST incident response lifecycle guidelines, from the earliest action to the final action.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence of incident response actions is: 1) Perform host-level containment by isolating the web server to a sandbox VLAN, 2) Execute eradication procedures by purging malicious artifacts and patching vulnerabilities, 3) Initiate recovery operations by restoring system software from a verified baseline and resuming production traffic, and 4) Conduct post-incident activities by documenting lessons learned and updating playbooks.
Standard incident response frameworks (NIST SP 800-61 and ISO 27035) dictate a strict sequence: Containment -> Eradication -> Recovery -> Post-Incident Activity. First, the affected asset must be isolated (containment) to stop lateral movement and C2 traffic while preserving volatile evidence. Second, malicious artifacts (web shell) and vulnerabilities must be removed (eradication). Third, systems are rebuilt and reintegrated into production (recovery). Finally, post-incident activities analyze root causes and update IR playbooks.

Step-by-Step Solution

1
Identify the immediate priority post-detection: Containment.
Containment limits adversary expansion; isolation to a quarantine VLAN halts lateral movement while preserving volatile evidence.
According to NIST SP 800-61, containment must precede eradication to ensure the attacker cannot pivot or deploy destructive counter-measures during cleanup.
2
Identify the remediation phase: Eradication.
Eradication removes threat components (web shell) and remediates underlying vulnerabilities (patch application, credential revocation).
Eradication ensures that the host and network environment are fully cleaned of malicious artifacts before attempting service restoration.
3
Identify the operational restoration phase: Recovery.
Recovery restores clean configurations, reinstates production connectivity, and applies targeted monitoring.
Restoration to production can only safely occur once eradication of the threat vector and vulnerability remediation are confirmed.
4
Identify the evaluation and closure phase: Post-Incident Activity.
Lessons learned are documented, and security playbooks are updated based on incident metrics.
Post-incident analysis ensures long-term security posture enhancements and satisfies compliance requirements after system recovery.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Phases (Containment -> Eradication -> Recovery -> Post-Incident Activity)
Estimated Time:2m 0s
Question 174Question →

A security analyst receives an alert regarding an obfuscated command executing on a workstation assigned to an executive assistant. Traditional signature-based antivirus software on the host reported no malicious findings because the command payload was executed directly in memory without writing a file to the disk. However, the Endpoint Detection and Response (EDR) agent flagged the activity and blocked execution based on the anomalous process relationship where a word processing application spawned an encoded shell interpreter. Which EDR capability enabled the detection and intervention in this scenario?

Show answer & explanation

Answer: Behavioral anomaly detection and process lineage tracking

Answer

Behavioral anomaly detection and process lineage tracking enabled the EDR agent to detect and prevent the fileless memory execution.
The correct answer highlights behavioral anomaly detection and process lineage tracking. EDR solutions continuously record endpoint telemetry, including process trees, memory allocations, and command-line arguments. This allows EDR to identify suspicious behavior—such as a word processor spawning a command-line interpreter—even when no known malicious file signature exists.

Step-by-Step Solution

1
Analyze the attack vector and host indicators described in the scenario.
Identified that the attack uses fileless/in-memory execution by spawning a shell interpreter from a office document application without writing malicious files to disk.
Understanding the attack mechanism clarifies why signature-based controls fail.
2
Compare traditional antivirus capabilities with EDR functionalities.
Legacy antivirus relies on static file signatures and hashes, whereas EDR records host telemetry, tracks parent-child process lineage, and analyzes execution behaviors in real time.
Differentiating control mechanisms points to behavioral detection as the key capability.
3
Match the observed EDR intervention to the correct security feature.
The EDR agent detected the anomalous process lineage (word processor launching an encoded shell) and intervened dynamically.
Process lineage monitoring and behavioral heuristics directly address fileless and zero-day execution techniques.

Key Concept

EDR Behavioral Detection and Process Telemetry
Estimated Time:1m 15s
Question 175Question →

During an active incident investigation, a security analyst confirms that an employee's workstation is currently communicating with an external command-and-control (C2) server following a malware infection. According to standard incident response lifecycle guidelines, which of the following actions should the analyst take FIRST?

Show answer & explanation

Answer: Isolate the compromised workstation from the internal network.

Answer

Isolate the compromised workstation from the internal network.
Isolating the compromised system from the network is the primary immediate containment action. Containment prevents data exfiltration and restricts the threat actor from moving laterally across the network while incident responders prepare eradication and forensic analysis steps.

Step-by-Step Solution

1
Identify the current phase of the incident response process.
The incident has been detected and verified, moving the response directly into the Containment phase.
Once an active compromise (such as active C2 communication) is detected, immediate action must be taken to limit damage.
2
Select the immediate containment step.
Network isolation of the host disconnects C2 channels and stops network spread.
Containment must occur prior to performing eradication (removing malware/re-imaging) or recovery (restoring operations).

Key Concept

Incident Response Lifecycle Phase Order (Containment First)
Question 176Question →

A digital forensics responder is preparing to collect evidence from a powered-on target workstation. Place the following memory and storage components in the correct sequence according to the standard Order of Volatility, starting from the MOST volatile to the LEAST volatile.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order from most volatile to least volatile is: CPU registers and cache memory, followed by System RAM (Random Access Memory), then Local solid-state drive (SSD) storage, and finally Archival backup tape media.
According to standard digital forensics guidelines (such as RFC 3227), evidence collection must proceed from the most transient/volatile data to the least volatile data. CPU cache and registers change constantly and are lost first, followed by system RAM. Local disk storage retains data permanently across reboots, while offline archival tapes are static and non-volatile.

Step-by-Step Solution

1
Identify the data source with the shortest lifespan
CPU registers and cache memory are identified as the most volatile because contents change continuously during CPU cycles.
Data in registers and processor cache is extremely transient and easily overwritten or cleared.
2
Identify volatile system runtime memory
System RAM is placed second.
RAM contains live system memory (running processes, network sockets, unencrypted secrets) which disappears when the host loses power.
3
Identify non-volatile local storage
Local SSD storage is placed third.
Disk storage persists data across power cycles and system reboots, making it significantly less volatile than RAM or CPU cache.
4
Identify long-term offline storage
Archival backup tape media is placed last.
Archival backups are offline, highly resilient, and change least frequently among all listed sources.

Key Concept

Order of Volatility in Digital Forensics
Question 177Question →

During a multi-vector attack on a hybrid enterprise infrastructure, a security operations team identifies active data exfiltration using a compromised cloud service account API key, alongside automated ransomware scripts terminating database processes on internal servers. To effectively mitigate damage and recover services according to standard incident response frameworks, what is the correct chronological sequence of steps the response team must execute?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with credential revocation and IP blocking (Containment), followed by volatile memory and disk forensic acquisition (Analysis/Preservation), followed by malware and persistence removal (Eradication), followed by clean backup restoration and integrity verification (Recovery), and concludes with a formal lessons-learned post-incident review (Post-Incident Activity).
According to NIST SP 800-61 and industry standard IR playbooks, containment (revoking compromised credentials and blocking origin IPs) must occur immediately to stop active exfiltration. Evidence acquisition (memory and disk forensic imaging) must follow prior to modifying systems. Eradication (purging malware binaries and persistence) ensures the adversary cannot maintain access. Recovery (restoring from clean offline backups and integrity validation) safely brings operations back online. Finally, post-incident activity (lessons learned and playbook updates) synthesizes the findings to improve future response.

Step-by-Step Solution

1
Execute immediate Containment controls by revoking compromised cloud API keys and applying perimeter IP blocks.
Stops ongoing data exfiltration and blocks active command-and-control communication.
Containment limits the scope of damage before additional actions are taken.
2
Perform Evidence Acquisition by capturing volatile memory and disk images from targeted database hosts.
Preserves forensic artifacts without altering volatile evidence needed for investigation.
Eradication or system re-imaging without prior forensic capture destroys volatile memory evidence.
3
Execute Eradication by removing ransomware artifacts, backdoor accounts, and scheduled tasks.
Completely eliminates the threat actor's presence and malware components from the environment.
Systems cannot be safely restored until all malicious presence has been removed.
4
Perform Recovery by restoring databases from known-good offline backups and validating system functionality.
Returns production services to normal operational state safely.
Restoration must occur after eradication to prevent re-infection upon bringing systems back online.
5
Conduct Post-Incident Activity including root-cause reporting and updating incident playbooks.
Improves security posture and response playbooks for future incidents.
Post-incident review requires complete incident resolution and documentation to evaluate overall performance.

Key Concept

NIST SP 800-61 Incident Response Lifecycle Sequencing
Estimated Time:3m 0s
Question 178Question →

During off-hours monitoring, a Security Operations Center (SOC) analyst receives an automated alert indicating that a newly created cloud IAM access key assigned to a staging service account is actively issuing bulk API requests to download objects from a production database backup S3 bucket to an unrecognized external IP address. After verifying that the API calls originate from unauthorized external sources and represent active data exfiltration, which of the following actions should the analyst take FIRST according to standard incident response playbooks?

Show answer & explanation

Answer: Revoke the compromised IAM access key and apply an temporary explicit deny policy to the service account.

Answer

Revoke the compromised IAM access key and apply an temporary explicit deny policy to the service account.
When an active incident involving credential compromise and ongoing data exfiltration is confirmed, the immediate priority in standard incident response frameworks (such as NIST SP 800-61) is containment. Revoking the compromised access key immediately halts the unauthorized API sessions and stops ongoing exfiltration.

Step-by-Step Solution

1
Identify the current phase of the NIST Incident Response Lifecycle.
The incident is actively occurring with ongoing exfiltration, placing the response squarely in the Containment, Eradication, and Recovery phase, specifically requiring immediate Containment.
Containment limits the scope and impact of an active breach before further damage occurs.
2
Select the action that directly mitigates active exfiltration without skipping containment.
Disabling or revoking the active vector (the compromised IAM credential) immediately halts unauthorized API requests.
Revoking the access key breaks the attacker's active session and stops ongoing data loss instantly.

Key Concept

Incident Response Containment Phase
Question 179Question →

An incident response team discovers a server on the enterprise network actively communicating with a known malicious command-and-control server following a ransomware infection. According to standard incident response playbooks for the containment phase, which of the following actions should the analyst perform immediately? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Disconnect the network interface of the affected server.; Capture the volatile system memory (RAM) for forensic examination.

Answer

Disconnecting the network interface of the affected server and capturing volatile system memory (RAM).
During the containment phase of incident response, the primary objectives are limiting the scope of damage and preserving volatile evidence. Disconnecting the server's network interface halts communication with command-and-control servers and prevents lateral spread across the network. Capturing system RAM preserves crucial volatile evidence, such as encryption keys, active connections, and memory-resident malware payloads, before the system state is modified.

Step-by-Step Solution

1
Identify the current lifecycle phase
The incident is actively occurring, placing the current response effort squarely in the Containment phase.
Containment actions focus on preventing further damage and lateral movement while preserving evidence.
2
Select immediate network containment
Isolating the system stops active C2 traffic and lateral spread.
Physical or virtual network disconnection isolates the threat without destroying evidence in RAM.
3
Preserve volatile evidence
RAM contents are captured prior to system reboot or power-down.
Volatile memory contains transient threat artifacts that are lost upon system shutdown.

Key Concept

Incident Response Containment Phase Actions
Question 180Question →

A security analyst monitoring a SOC console receives a high-severity alert from an Endpoint Detection and Response (EDR) agent on an enterprise workstation. The alert details rapid unauthorized file encryption and concurrent attempts at internal lateral movement. Which of the following containment actions should the analyst execute FIRST directly within the EDR console to minimize risk to the enterprise?

Show answer & explanation

Answer: Isolate the affected workstation from the network using the EDR agent isolation capability.

Answer

Isolate the affected workstation from the network using the EDR agent isolation capability.
Isolating the host via the EDR console instantly restricts network traffic from the host, preventing the spread of ransomware and lateral movement while maintaining an operational connection between the SOC analyst and the EDR agent for telemetry analysis.

Step-by-Step Solution

1
Analyze the incident response phase requirement.
Determine that the incident is actively progressing (rapid file encryption and lateral movement) and requires immediate containment.
Containment must occur before investigation or eradication to prevent widespread enterprise impact.
2
Select the appropriate EDR feature for host containment.
Execute network isolation via the EDR console interface.
EDR isolation severs host network communications (preventing lateral movement) while maintaining a managed telemetry link for security analysts.

Key Concept

Host Network Isolation in Endpoint Detection and Response
PreviousPage 9 / 32Next
Security Operations Practice Questions — CompTIA Security+ — Page 9 | Examkin