Tüm alıştırma soruları

A Security Operations Center (SOC) analyst is reviewing an automated response playbook triggered by an Endpoint Detection and Response (EDR) agent following a suspected credential dumping attack against a high-value server. In what chronological sequence should the EDR agent and SOC workflow execute these actions to contain the threat and preserve forensic evidence?

A security analyst conducts both a credentialed host vulnerability assessment and a non-credentialed network scan against a critical Linux database server. The non-credentialed network scan reports zero critical vulnerabilities, whereas the credentialed scan identifies multiple unpatched kernel vulnerabilities and weak local file permissions. Additionally, internal host firewalls on the server are configured to drop ICMP and block unauthenticated port probing from outside the local management subnet. Which of the following best explains the discrepancy between the two scan results?

An IAM administrator at an enterprise health system is conducting emergency offboarding for a compromised account. The administrator disables the user's account in the on-premises Active Directory. However, an hour later, security operations detects ongoing unauthorized administrative API calls performed in the cloud SaaS platform using that identity. Upon reviewing the SCIM bridge synchronization logs, the analyst observes the following log entries:

[2026-07-27 14:02:11] WARN scim_sync_engine: PATCH /Users/usr_88291 HTTP/1.1 429 Too Many Requests - Rate limit exceeded. Account deprecation push failed.
[2026-07-27 14:02:11] INFO scim_sync_engine: Exponential backoff retry scheduled for 14,400 seconds.
[2026-07-27 14:15:00] AUDIT saas_api_gateway: Token authentication successful for usr_88291 via Bearer JWT. Active session valid.

Which of the following operational remediation actions should the analyst take FIRST to immediately terminate the unauthorized active cloud session?

During a routine audit of enterprise endpoint logs, a threat hunter discovers an unauthorized, memory-resident process running on an HR file server that is actively sending encrypted outbound beacons to a suspicious external IP address. Initial investigation confirms an active Command and Control (C2) connection. According to standard incident response frameworks, which of the following actions should the security team take FIRST?

An EDR console triggers a high-severity behavioral alert on an enterprise application server after detecting an obfuscated PowerShell execution that attempts process injection into a legitimate system process and initiates an outbound connection to an unknown external IP address. Which of the following initial containment and investigation actions should the security analyst perform directly using EDR console capabilities? (Select TWO.)

Following an alert indicating that an unauthorized process attempted to dump LSASS memory on a corporate workstation, a security analyst needs to prevent the compromised host from communicating with internal network assets while preserving the host's active connection to the central EDR console for remote incident triage. Which of the following capabilities should the analyst execute?

During an active incident investigation on an enterprise Linux application server, an incident responder detects suspicious process execution originating from a kernel module. The server remains powered on and connected to the internal network segment. To preserve evidence while minimizing the loss of transient data, which of the following actions should the analyst perform FIRST according to the order of volatility?

During a security assessment of a legacy network daemon written in C, security engineers identify that user-supplied input is copied directly into a fixed-size stack buffer using the `strcpy()` function without length checking. A junior developer proposes deploying a Web Application Firewall (WAF) to filter incoming traffic as the primary remediation. Which statement best evaluates the proposed solution and identifies the most effective remediation?

A Security Operations Center (SOC) analyst wants to standardize and automate the incident response steps for phishing alerts. The workflow needs to automatically extract suspicious URLs, query threat intelligence sources, and isolate affected endpoints without manual intervention. Which SOAR component should the analyst configure to execute this automated sequence of actions?

An analyst receives an automated intrusion detection alert indicating suspicious outbound traffic from a workstation. Place the initial network security monitoring and triage steps in the correct chronological order from first to last.

A security operations center (SOC) detects an active compromise of an administrative account with elevated privileges across hybrid cloud infrastructure. To contain the incident and restore secure identity operations according to privileged access management (PAM) best practices, place the mitigation and lifecycle remediation steps in the correct chronological sequence.

A renewable energy utility operates remote maintenance workstations connected to solar farm Supervisory Control and Data Acquisition (SCADA) controllers. Under the existing access model, once a field technician completes initial multi-factor authentication (MFA) at the start of their shift, the active network connection is granted persistent trust across all internal SCADA subnets. The organization wants to refactor this workflow to align with core Zero Trust Architecture principles. Which of the following implementation strategies best satisfies this requirement?

Match each vulnerability assessment scan type to its defining operational characteristic.

During a high-volume credential stuffing campaign targeted at an enterprise web portal, an automated Security Orchestration, Automation, and Response (SOAR) playbook is triggered upon detecting repeated failed authentication alerts. To rapidly mitigate the active attack while minimizing the risk of self-inflicted service outages on critical infrastructure, which of the following actions should be configured as the initial automated response step in the playbook?

Place the typical steps of an automated Security Orchestration, Automation, and Response (SOAR) incident playbook in the correct operational sequence from first to last.

A security administrator is evaluating a high-availability perimeter firewall pair deployed in an active-passive failover configuration. During a scheduled failover simulation, the secondary appliance successfully assumed the virtual IP address and began handling traffic, but all active client TCP sessions were abruptly dropped, forcing users to re-authenticate. The administrator must update the architecture so that existing connection states persist uninterrupted across failover events. Which of the following solutions should the administrator implement?

An incident response team is reviewing operational logs from an enterprise Privileged Access Management (PAM) system after an emergency database restoration. The following audit log snippet was recorded during the incident:

[11:02:15] PAM_VAULT: Account 'bg_admin01' checked out by user 'j.doe'. Reason: INC-9904.
[11:02:16] PAM_VAULT: Temporary credentials issued; rotate-on-checkin timer active (4 hours).
[11:02:20] PAM_PROXY: SSH session initiated to target 'db-prod-01' by 'bg_admin01'. Live session recording enabled.
[11:45:10] PAM_VAULT: Account 'bg_admin01' manually checked back in by user 'j.doe'.

Based on identity and access management operational standards, which automated action should the PAM solution perform immediately upon account check-in?

An enterprise infrastructure team discovers that an infected internal workstation executed fileless malware that established an encrypted outbound connection to an external command-and-control server. Traditional signature-based antivirus and perimeter firewalls failed to identify or restrict the malicious activity. To contain the active compromise immediately while ensuring SOC analysts retain remote telemetry collection and administrative management access to the host, which of the following Endpoint Detection and Response (EDR) capabilities should be executed?

A security analyst at a global logistics firm is reviewing central SIEM authentication logs following an automated threat alert. The log snippet reveals the following sequential events:

text
[08:15:02 UTC] IdP_SSO SUCCESS User: [email protected] Src_IP: 198.51.100.45 (New York, US) Auth: SAML+FIDO2
[08:16:35 UTC] Legacy_VPN SUCCESS User: [email protected] Src_IP: 203.0.113.88 (London, UK) Auth: RADIUS/PAP
[08:18:10 UTC] PAM_Gateway ALERT User: [email protected] Direct SSH attempt to Core_DB bypassing PAM proxy

Based on these logs, which of the following measures should the security team implement to contain the threat and mitigate the underlying operational IAM vulnerability? (Select TWO.)

A security operations team is refining its enterprise vulnerability management program to address scanning anomalies, deployment gaps, and risk prioritization metrics across diverse infrastructure assets. Match each vulnerability scanning scenario to its most appropriate operational response or root cause analysis.