Examkin

Security Operations

627 soru

Tüm türler627Çoktan seçmeli320Çoklu seçim139Eşleştirme36Sıralama132
Soru 201Soru →

During a active security incident, a enterprise Security Operations Center (SOC) team detects that an attacker has gained persistence on an internal domain-joined SQL database server containing highly sensitive PII. Forensics logs reveal the attacker established a reverse shell via a web application vulnerability and is currently conducting live internal network scanning and attempting lateral movement via Server Message Block (SMB). According to the NIST Incident Response Framework (SP 800-61 Rev. 2), which of the following actions should the incident response team perform IMMEDIATELY as part of the Containment phase? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Apply host-based firewall rules to block inbound and outbound traffic on the affected SQL server while preserving established network connections for memory dump acquisition.; Isolate the compromised database service account by temporarily disabling it in Active Directory and revoking active Kerberos ticket granting tickets (TGTs).

Cevap

The incident response team should apply host-based firewall rules to isolate network traffic while preserving memory for forensic preservation, and disable the compromised Active Directory service account while revoking active session tokens.
Isolating network traffic through host firewall rules and revoking compromised credentials directly contain the adversary's lateral movement and active sessions while protecting volatile RAM for memory forensics.

Adım Adım Çözüm

1
Identify current incident phase
The incident is actively occurring; active lateral movement and C2 require immediate containment actions.
Containment limits the scope of damage and prevents further adversary access while volatile evidence is collected.
2
Select appropriate containment controls
Host isolation via firewall controls stops lateral movement, and disabling compromised credentials prevents ongoing session abuse.
These actions contain the threat without altering volatile system memory needed for forensic evaluation.
3
Evaluate and filter out-of-order phase actions
Re-imaging systems belongs to Eradication/Recovery, while post-mortem reviews belong to Post-Incident Activity.
Prematurely executing eradication or lessons learned violates NIST lifecycle sequence rules.

Anahtar Kavram

NIST Incident Response Lifecycle (Containment Strategy and Phase Sequencing)
Soru 202Soru →

A security analyst is initiating a digital forensics investigation on a compromised live application server. Which of the following actions should the analyst perform to adhere to proper evidence preservation and chain of custody procedures? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Capture the active system RAM before shutting down or rebooting the server.; Calculate and record SHA-256 cryptographic hashes for all disk images immediately upon acquisition.

Cevap

The analyst should capture active system RAM before shutting down the server and calculate SHA-256 cryptographic hashes for disk images immediately upon acquisition.
Capturing active RAM prior to system shutdown preserves highly volatile evidence according to the order of volatility. Calculating and recording cryptographic hashes immediately upon image acquisition ensures evidence integrity and supports chain of custody proof in legal proceedings.

Adım Adım Çözüm

1
Identify the most volatile evidence components.
System RAM is identified as highly volatile and must be captured while the server remains powered on.
Shutting down the server clears RAM contents, resulting in permanent loss of volatile evidence.
2
Establish evidence integrity baseline upon collection.
Cryptographic hashes (e.g., SHA-256) are generated immediately after image acquisition.
Hashes provide proof that the forensic image was not modified during handling or analysis.

Anahtar Kavram

Digital Forensics Order of Volatility and Chain of Custody Integrity
Soru 203Soru →

A cybersecurity forensic analyst has just completed a bit-stream disk acquisition of a target drive seized during an insider threat investigation. The analyst must now process and secure the physical drive and digital image to ensure legal admissibility in court. Place the following evidence handling and chain of custody steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological order for preserving forensic disk evidence is: (1) Generate and document a baseline cryptographic hash of the acquired forensic image, (2) Complete the initial chain of custody log entry with item details, timestamps, collector identity, and baseline hash value, (3) Place the original drive into an antistatic tamper-evident bag and apply a signed tamper-proof seal, and (4) Deposit the sealed evidence package into a secure evidence vault and log the storage location transfer.
Digital forensic integrity relies on immediate verification followed by meticulous documentation and physical security. First, generating a baseline cryptographic hash immediately after bit-stream acquisition verifies that the copy is exact and unaltered. Second, recording this hash alongside collector details, serial numbers, and timestamps on the chain of custody form creates an official legal record. Third, physically enclosing the drive in a sealed tamper-evident bag ensures protection against tampering and static. Finally, transferring the sealed item to a secure evidence locker and logging the location transfer maintains an unbroken chain of custody.

Adım Adım Çözüm

1
Verify baseline data integrity
Generating a SHA-256 hash immediately after image capture creates a mathematical signature of the evidence state.
Cryptographic hashes prove non-repudiation and verify that the evidence has not been tampered with or corrupted during acquisition.
2
Record chain of custody documentation
The collector logs essential metadata including collector name, date, time, serial number, and baseline hash.
Detailed documentation establishes accountability and legal defensibility before the evidence is packaged.
3
Package and seal physical evidence
The physical media is secured inside a anti-static tamper-evident bag with a signed security seal across the opening.
Physical sealing ensures protection against electrostatic discharge and detects any physical compromise.
4
Secure evidence and log custodial transfer
The sealed bag is transferred to an access-controlled evidence vault, and the transfer of custody log is updated.
Maintaining continuous custody tracking prevents claims of evidence contamination or unrecorded access.

Anahtar Kavram

Chain of Custody and Evidence Integrity Preservation Workflow
Soru 204Soru →

An organization is deploying an Endpoint Detection and Response (EDR) agent across all enterprise hosts. Which of the following core capabilities differentiate EDR solutions from traditional signature-based antivirus software? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Continuous real-time collection and analysis of endpoint behavioral telemetry; Remote network isolation of compromised hosts while preserving management access

Cevap

The features that distinguish EDR solutions from legacy antivirus are continuous real-time collection of endpoint behavioral telemetry and remote network isolation of compromised hosts.
Endpoint Detection and Response (EDR) solutions extend beyond traditional antivirus by continuously recording host behavioral telemetry (such as process trees, file modifications, and local network connections) and enabling rapid containment actions like network isolation of compromised endpoints.

Adım Adım Çözüm

1
Identify key EDR features.
EDR emphasizes continuous host telemetry collection and active containment options such as network isolation.
Legacy antivirus relies primarily on static file signatures, whereas EDR continuously analyzes behavior and provides direct incident response capabilities.
2
Evaluate wrong options.
IP reputation filtering is a network firewall control, and assuming internal host trustworthiness relies on perimeter trust rather than endpoint monitoring.
These distractor options represent perimeter control functions or flawed security assumptions rather than host EDR features.

Anahtar Kavram

Endpoint Detection and Response (EDR) Core Functions
Tahmini Süre:1m 0s
Soru 205Soru →

A security analyst is investigating a stealthy compromise on an enterprise server where an attacker executed an obfuscated script directly in host memory using native tools, avoiding writing any malicious files to the disk. Standard signature-based antivirus software and perimeter firewalls failed to detect the activity. Which capability of Endpoint Detection and Response (EDR) provides the visibility required to identify and trace this fileless execution?

Cevabı ve açıklamayı göster

Cevap: Continuous behavioral monitoring and process parent-child lineage tracking

Cevap

Continuous behavioral monitoring and process parent-child lineage tracking
The correct answer highlights EDR's ability to monitor ongoing endpoint behavior and process trees in real time. Because fileless attacks execute directly in volatile memory using native system binaries (Living off the Land), traditional static file checks fail. EDR solves this by recording runtime telemetry, including parent-child process chains and command-line parameters.

Adım Adım Çözüm

1
Analyze the attack vector described in the scenario
The attack uses fileless execution techniques, relying on memory-resident script execution via native binaries without dropping files to disk.
Understanding that no file was created eliminates static inspection methods that depend on file system artifacts.
2
Evaluate the capabilities of security monitoring technologies against fileless execution
EDR agents maintain continuous telemetry on process creation, memory activity, and execution arguments on host endpoints.
Process lineage tracking enables visibility into abnormal execution flows, such as a legitimate system utility spawning an unexpected command shell.
3
Select the option that specifically addresses host process and memory execution tracking
Continuous behavioral monitoring and process lineage tracking is the core EDR function designed for fileless threat detection.
It captures real-time endpoint behavioral anomalies regardless of file signature presence.

Anahtar Kavram

EDR Behavioral Telemetry & Fileless Threat Detection
Soru 206Soru →

An incident responder arrives at a compromised live workstation suspected of running volatile in-memory malware. To preserve digital evidence without destroying transient data, the responder must extract system artifacts in strict adherence to the forensic Order of Volatility (RFC 3227). In what sequence should the analyst collect the following evidence items, starting with the MOST volatile artifact (collected first) and ending with the LEAST volatile artifact (collected last)?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of collection from most volatile to least volatile is: CPU registers and cache contents, System RAM and active network socket tables, Swap file and pagefile contents on the local drive, Bit-stream image of the local secondary storage drive, and Off-site archival backup tapes.
Digital forensics standards (RFC 3227) mandate collecting evidence in order of lifetime volatility: CPU cache and registers change constantly (nanoseconds), System RAM and active network connections are cleared upon power-down (seconds to minutes), temporary swap/pagefiles retain paged data on disk, non-volatile local disk partitions persist across power cycles, and offline archival backup tapes remain stable over long periods.

Adım Adım Çözüm

1
Identify the most transient artifacts that change within nanoseconds.
CPU registers and cache contents must be acquired first because any processor instruction or context switch instantly overwrites this state.
Top tier of volatility per RFC 3227.
2
Capture main memory and running kernel state before rebooting or modifying system state.
System RAM and active network socket tables are extracted using live acquisition tools before any changes to operating system processes occur.
Volatile system memory loses all data upon host shutdown.
3
Extract temporary memory paging files stored on disk.
Swap files and pagefiles are collected next, as they contain remnants of volatile RAM swapped to disk during system operations.
Transient storage bridges the gap between dynamic RAM and static disk contents.
4
Perform bit-stream disk acquisition of non-volatile local drives.
A forensic duplicate of the secondary storage drive is imaged using a hardware write-blocker.
Non-volatile storage persists through power cycles and is captured after all live volatile memory artifacts.
5
Identify persistent offline and long-term archival evidence.
Off-site archival backup tapes are cataloged and secured last.
Offline backup media is highly static and has the lowest risk of immediate volatility or decay.

Anahtar Kavram

Order of Volatility (RFC 3227)
Soru 207Soru →

A security engineer is configuring an enterprise Security Information and Event Management (SIEM) pipeline to process raw web application traffic logs and detect potential SQL injection attacks. Arrange the following log processing and analysis stages in the correct sequential order from initial log generation to SOC notification.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence is: (1) Raw web server log generation, (2) Field parsing via regular expressions, (3) Data normalization into a common schema, (4) Contextual telemetry enrichment, (5) Correlation rule evaluation across time windows, and (6) SIEM alert generation and SOC escalation.
The SIEM pipeline strictly processes events in sequential stages: raw log creation at the host is followed by parsing string text into discrete key-value fields. Once parsed, fields are normalized to a common enterprise schema so correlation logic remains vendor-agnostic. Enriched telemetry (such as threat intelligence reputational scores) is added next. The correlation engine then compares the normalized, enriched events against time-window thresholds. Finally, matching correlation conditions trigger an automated alert and escalation in the SOC dashboard.

Adım Adım Çözüm

1
Identify the event origination point.
The web server creates raw log text locally upon receiving an HTTP request.
Log data must first exist at the source endpoint before it can be collected and processed by SIEM infrastructure.
2
Structure the raw data payload.
SIEM ingestion regex splits string data into discrete key-value pairs.
Unstructured text cannot be efficiently queried or correlated until field boundaries are extracted.
3
Standardize variable names.
Parsed fields map to standard enterprise schema tags.
Normalization ensures correlation logic written for one device type applies across all vendor formats.
4
Augment event data with security context.
Event record receives threat intelligence risk scores and geographic metadata.
Enrichment allows correlation engines to weigh contextual risk (e.g., suspicious IP reputation) during rule evaluation.
5
Analyze multi-event patterns.
Stateful correlation engine detects threshold breaches for malicious patterns within a specified timeframe.
Correlation links individual enriched events together to detect broader attack behaviors.
6
Trigger security response.
An actionable alert is pushed to the SOC queue.
Alert generation notifies analysts after correlation logic confirms a high-confidence security event.

Anahtar Kavram

SIEM Log Processing Pipeline Lifecycle
Soru 208Soru →

Following an security alert indicating active LSASS memory injection on a Windows Domain Controller, an incident investigator needs to collect digital evidence from the running system. To strictly adhere to the order of volatility and maintain evidence integrity, which of the following actions should the investigator perform FIRST?

Cevabı ve açıklamayı göster

Cevap: Dump physical RAM to an external destination and immediately generate a cryptographic hash of the captured memory file

Cevap

The investigator should dump physical RAM to an external destination and immediately generate a cryptographic hash of the captured memory file.
In digital forensics, evidence must be collected in sequence from most volatile to least volatile (Order of Volatility: CPU registers/cache -> RAM -> network state -> disk -> archival media). Physical RAM contains transient evidence of active attacks such as LSASS memory injection. Capturing RAM while the system is running and calculating an immediate cryptographic hash ensures evidence preservation and verifies chain of custody integrity.

Adım Adım Çözüm

1
Identify the volatility level of evidence sources on the target system.
Physical RAM (live memory) is higher on the order of volatility than disk swap files, system disk images, or static logs.
According to the Order of Volatility (RFC 3227), most volatile evidence must be collected first before it is lost due to power changes or system activity.
2
Acquire the live physical memory without altering system power state.
Live injection payloads and credentials stored in RAM are successfully captured.
Shutting down or rebooting the server would instantly erase RAM contents.
3
Compute a cryptographic hash (e.g., SHA-256) of the acquired memory image file.
A baseline hash is established for the chain of custody log.
Cryptographic hashing proves evidence integrity and ensures that collected data remains unaltered throughout legal and forensic proceedings.

Anahtar Kavram

Order of Volatility and Chain of Custody Integrity Verification
Soru 209Soru →

A security technician has isolated a physical hard drive containing forensic evidence from a workstation involved in an internal investigation. The technician must transport the drive to a secure off-site facility for forensic imaging. Which of the following actions is most critical to preserve the legal admissibility of the physical evidence during transport?

Cevabı ve açıklamayı göster

Cevap: Maintaining a chain of custody document that records every physical transfer, including dates, times, and signatures of handlers.

Cevap

Maintaining a chain of custody document that records every physical transfer, including dates, times, and signatures of handlers.
Maintaining a comprehensive chain of custody form ensures that every transfer of physical control is logged with exact dates, times, purpose, and signatures of all handlers. This documentation establishes evidence provenance and proves that the evidence was continuously safeguarded against unauthorized access or modification.

Adım Adım Çözüm

1
Identify the primary requirement for legal evidence admissibility during physical transport.
Recognize that proof of continuous control and documentation of handler custody is mandatory.
Forensic evidence must be accounted for at all times to prevent allegations of evidence tampering or loss of integrity.
2
Evaluate operational procedures against digital forensics standards.
Logging each transfer with exact timestamps, handler identities, and signatures establishes a unbroken chain of custody.
Chain of custody forms provide verifiable proof of evidence provenance in judicial proceedings.

Anahtar Kavram

Chain of Custody and Evidence Provenance
Soru 210Soru →

A digital forensics investigator receives an external solid-state drive (SSD) delivered by a courier as part of an ongoing insider threat investigation. The drive is stored in an anti-static evidence bag with a tamper-evident seal and is accompanied by a chain of custody log detailing its initial acquisition and cryptographic hash. Which of the following steps should the investigator perform first upon receiving the physical evidence?

Cevabı ve açıklamayı göster

Cevap: Inspect the tamper-evident seal, sign the chain of custody form to document the transfer of possession, and attach the drive to a hardware write-blocker before taking verification hashes.

Cevap

Inspect the tamper-evident seal, sign the chain of custody form to document the transfer of possession, and attach the drive to a hardware write-blocker before taking verification hashes.
The correct answer emphasizes verifying physical evidence seals, immediately logging the transfer of control on the chain of custody form, and utilizing hardware write-blocking controls prior to mounting or hashing the evidence. This ensures evidence remains untampered and legal chain of custody is strictly preserved.

Adım Adım Çözüm

1
Verify physical evidence package integrity
Ensure the tamper-evident seal is undamaged and matches the seal ID listed on the accompanying documentation.
Physical integrity verification proves evidence was not modified or tampered with in transit.
2
Log custody transfer
Sign and date the chain of custody log indicating formal receipt of the storage drive from the courier.
Maintaining an unbroken chain of custody is mandatory for evidence admissibility.
3
Prepare for evidence acquisition
Connect the drive to a hardware write-blocking device prior to plugging it into the forensic workstation.
Write-blockers prevent the host operating system from writing data or updating access timestamps on the original evidence drive.

Anahtar Kavram

Chain of Custody and Forensic Evidence Intake
Tahmini Süre:1m 30s
Soru 211Soru →

During security monitoring, a Security Operations Center (SOC) analyst verifies that a database server hosting critical business records has executed an unauthorized executable from a temporary directory and opened an active outbound connection to a suspicious external endpoint. The threat analyst confirms the host is compromised. According to standard incident response process frameworks, which of the following actions should the analyst perform FIRST?

Cevabı ve açıklamayı göster

Cevap: Isolate the compromised database server from the network while maintaining host power to preserve volatile memory evidence.

Cevap

Isolate the compromised database server from the network while maintaining host power to preserve volatile memory evidence.
In standard incident response frameworks (such as NIST SP 800-61), once an incident is verified, the immediate priority is containment. Isolating the server from the network prevents the adversary from exfiltrating data or moving laterally to other enterprise resources. Keeping the machine powered on ensures volatile memory (RAM) is preserved for forensic analysis.

Adım Adım Çözüm

1
Identify the current incident response phase based on the scenario state.
The compromise is confirmed, placing the current activity at the transition between Detection/Analysis and Containment.
Once an active breach is verified, preventing lateral movement and further data exfiltration is mandatory prior to remediation.
2
Select the immediate containment step that preserves forensic artifacts.
Isolating the system at the network level stops adversary communication while preserving RAM volatile data.
NIST SP 800-61 Rev. 2 guidelines mandate limiting incident impact (containment) as the immediate next step after detection.

Anahtar Kavram

Incident Response Lifecycle - Containment Phase Execution
Soru 212Soru →

A Security Operations Center (SOC) analyst is investigating a cross-environment security alert in a SIEM console. The alert correlates web application server logs with cloud audit logs across a 5-minute timeframe:

Log Snippet 1 (Nginx Web Server Access Log):
`192.0.2.45 - - [27/Jul/2026:14:22:10 +0000] "GET /api/v1/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/AppRole HTTP/1.1" 200 1423 "-" "Mozilla/5.0"`

Log Snippet 2 (CloudTrail Security Audit Log):
`{"eventTime": "2026-07-27T14:25:04Z", "eventName": "ListBuckets", "userARN": "arn:aws:iam::123456789012:role/AppRole", "sourceIPAddress": "198.51.100.89", "userAgent": "aws-sdk-python/1.26.0"}`

Based on the correlated log telemetry, which of the following best describes the attack vector executed and the log indicator confirming successful exploitation?

Cevabı ve açıklamayı göster

Cevap: A Server-Side Request Forgery (SSRF) attack exfiltrated IAM temporary role credentials from the instance metadata service (IMDS), confirmed by CloudTrail logging API requests issued from an external IP address (198.51.100.89) using the compromised role.

Cevap

A Server-Side Request Forgery (SSRF) attack exfiltrated IAM temporary role credentials from the instance metadata service (IMDS), confirmed by CloudTrail logging API requests issued from an external IP address (198.51.100.89) using the compromised role.
The correct answer accurately identifies Server-Side Request Forgery (SSRF) aimed at the internal cloud metadata address (169.254.169.254). The Nginx log demonstrates an attacker abusing a URL parameter to fetch temporary access tokens for the AppRole. The corresponding CloudTrail log confirms that the stolen temporary credentials were subsequently used by an external IP address (198.51.100.89) to execute the ListBuckets API call.

Adım Adım Çözüm

1
Analyze Nginx access log snippet for web application vector
Identified a GET request to `/api/v1/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/AppRole` returning HTTP 200. This is a classic SSRF pattern targeting the cloud Instance Metadata Service (IMDS) to retrieve temporary security credentials.
The `url=` query parameter indicates the application fetches arbitrary external/internal URLs provided by user input without proper sanitization.
2
Analyze CloudTrail audit log snippet for credential usage
Event `ListBuckets` was called using `arn:aws:iam::123456789012:role/AppRole` from external source IP `198.51.100.89` via Python SDK (`aws-sdk-python`).
Instance roles are intended to be used directly by the EC2 instance host. Originating API calls from an unexpected external public IP indicates an attacker obtained the secret key/token from IMDS and configured local AWS CLI/SDK tools.
3
Correlate telemetry timeline and synthesize root cause
The web log entry at 14:22:10 UTC exfiltrated credentials, which were then used at 14:25:04 UTC by the attacker's workstation (198.51.100.89) to enumerate S3 buckets.
SIEM event correlation rules trigger on sequential events linking web application SSRF telemetry with anomalous external API calls using host-assigned IAM roles.

Anahtar Kavram

Log Correlation for Server-Side Request Forgery (SSRF) and Cloud Credential Theft
Soru 213Soru →

An enterprise security team detects that an automated build server within their CI/CD pipeline has been compromised by an attacker executing unauthorized external network sweeps and downloading secondary payloads. The incident response plan has entered the containment phase. Which of the following actions should the incident response team perform during this phase? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Isolate the compromised build server from the internal network by modifying its virtual security group or network interface settings.; Capture a complete volatile memory (RAM) snapshot of the compromised server prior to taking the host offline or rebooting.

Cevap

The incident response team should isolate the compromised build server from the network and capture a volatile memory (RAM) snapshot before powering down or re-imaging the host.
During the containment phase, the priority is to stop the incident from spreading while preserving evidence. Modifying network security settings to isolate the host prevents further lateral movement and C2 communications. Capturing volatile memory before rebooting or disconnecting ensures that live process states, active network connections, and unencrypted keys are captured following the order of volatility.

Adım Adım Çözüm

1
Identify the primary objectives of the Containment phase in NIST SP 800-61 / ISO 27035 IR frameworks.
The immediate goals are preventing further damage/lateral movement and preserving volatile evidence.
Containment limits the scope of an incident without destroying volatile forensic evidence necessary for root-cause analysis.
2
Evaluate containment options against evidence preservation rules.
Isolating the system via network controls stops network egress/sprouting while keeping memory intact. Capturing RAM preserves volatile state before memory is lost.
Taking volatile captures prior to host shutdown adheres to the order of volatility.
3
Differentiate containment actions from eradication, recovery, and post-incident activities.
System re-imaging belongs to Eradication/Recovery, while updating policies belongs to Post-Incident Activity (Lessons Learned).
Performing remediation or policy update steps out of order disrupts the incident response process and compromises forensic investigations.

Anahtar Kavram

Incident Response Lifecycle Phases and Containment Strategies
Tahmini Süre:1m 30s
Soru 214Soru →

An incident response team is conducting live digital forensics on a powered-up enterprise database server experiencing active kernel-level malware execution and network exfiltration. To prevent the loss of critical evidence during acquisition, in what exact sequence should the investigator collect the following digital evidence sources, starting with the MOST volatile source and ending with the LEAST volatile source?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence from most volatile to least volatile is: CPU registers and cache memory → System RAM and active network/kernel tables → Temporary file systems and swap space → Local non-volatile NVMe/SSD storage → Off-site archived backup media.
In digital forensics, evidence acquisition follows RFC 3227 Order of Volatility guidelines to ensure ephemeral data is captured before it evaporates or gets overwritten. CPU registers and L1/L2/L3 cache represent the most volatile tier because data shifts within nanoseconds. Physical RAM, active network sockets, ARP tables, and running process tables form the second tier because they rely on continuous system power. Pagefiles and swap space form the third tier; while located on disk, their contents change rapidly during OS memory swapping. Local persistent storage (SSDs/NVMe) is non-volatile and forms the fourth tier. Off-site archival media and cold backups are static long-term records, placing them in the final, least volatile tier.

Adım Adım Çözüm

1
Apply the RFC 3227 Order of Volatility guidelines for digital evidence collection.
Standard hierarchy established: Registers/Cache > System RAM/Kernel Tables > Swap/Temp Files > Local Disk Storage > Remote/Archival Media.
Volatile evidence collection must prioritize storage components with the shortest lifespan to prevent automated memory decay or overwriting.
2
Identify CPU hardware state data as position 1.
Item 1 (CPU registers, L1/L2/L3 cache) is placed first.
Processor registers and cache levels change continuously with every clock instruction cycle, making them extremely transient.
3
Identify system volatile RAM and live kernel structures as position 2.
Item 2 (System RAM, ARP cache, kernel tables) is placed second.
Random access memory depends on constant electrical charge and active power, losing all context immediately upon shutdown or power failure.
4
Identify virtual memory paging and swap structures as position 3.
Item 3 (Swap space, pagefile.sys, temporary file systems) is placed third.
Paging files reside on physical disk sectors but undergo rapid dynamic updates during memory swapping operations.
5
Identify local persistent drive storage as position 4.
Item 4 (Local non-volatile storage, NVMe, SSD) is placed fourth.
Local solid-state or magnetic drives are non-volatile and maintain stored data without electrical power.
6
Identify off-site long-term backups as position 5.
Item 5 (Off-site archived backup tapes, cold cloud snapshots) is placed fifth.
Archival storage backups are static, stored offline or in write-once repositories, and present zero risk of immediate volatile alteration.

Anahtar Kavram

Order of Volatility (RFC 3227)
Tahmini Süre:2m 30s
Soru 215Soru →

An organization is deploying an Endpoint Detection and Response (EDR) agent across its fleet of enterprise workstations to enhance host-level threat detection and incident containment capabilities. Which of the following represent core operational features provided by an EDR solution? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Continuous host telemetry collection and behavioral monitoring of active processes, registry changes, and memory executions; Automated host network isolation to stop lateral movement upon high-confidence threat detection

Cevap

The correct answers are the continuous host telemetry collection and behavioral monitoring of active processes, registry changes, and memory executions, along with automated host network isolation to stop lateral movement upon high-confidence threat detection.
Endpoint Detection and Response (EDR) agents provide continuous visibility into host activity by recording behavioral telemetry (process creation, file writes, network sockets, memory allocation) and support active response mechanisms like automated endpoint isolation to mitigate malicious lateral movement.

Adım Adım Çözüm

1
Identify the primary scope of Endpoint Detection and Response (EDR) technology.
EDR focuses specifically on host-level security observability, behavioral telemetry, continuous recording of system events, and proactive containment.
Understanding the boundary between endpoint monitoring and network/perimeter controls helps isolate valid EDR features.
2
Evaluate options offering continuous monitoring and automated containment.
Real-time process telemetry logging and automated network isolation of compromised host devices are standard EDR functions.
EDR replaces legacy signature-only scanning with continuous monitoring and automated playbooks for incident containment.
3
Differentiate EDR from network perimeter controls and legacy signature-based antivirus.
Edge traffic inspection belongs to network firewalls/IPS, while signature-based batch disk scanning characterizes legacy antivirus.
EDR operates on the endpoint itself using behavioral monitoring rather than relying on perimeter filtering or static signatures.

Anahtar Kavram

Core capabilities of Endpoint Detection and Response (EDR)
Soru 216Soru →

A technician identifies an active malware infection on an enterprise desktop. To stop lateral movement without losing volatile memory evidence, the technician uses the Endpoint Detection and Response (EDR) console. Which of the following capabilities should the technician execute?

Cevabı ve açıklamayı göster

Cevap: Perform host network isolation via the EDR agent

Cevap

Perform host network isolation via the EDR agent
Performing host network isolation directly through the EDR agent prevents the endpoint from communicating with any local or remote network resources, halting lateral malware propagation while maintaining machine power so security responders can harvest volatile RAM memory.

Adım Adım Çözüm

1
Identify the primary operational constraint and goal
The goal is to halt lateral threat movement immediately while preserving volatile system memory (RAM).
Shutting down the host loses volatile evidence, while network-based filtering does not block internal local communication effectively.
2
Evaluate EDR endpoint control capabilities
Host network isolation cuts off all host network interface adapters remotely via the installed EDR agent while keeping system state active.
This isolates the compromised host from the enterprise network without powering down the device.

Anahtar Kavram

EDR Host Isolation and Volatile Evidence Preservation
Soru 217Soru →

A forensic analyst is responding to an active security incident involving a bare-metal hypervisor suspected of hosting a sophisticated, memory-resident kernel rootkit that utilizes Direct Memory Access (DMA) to exfiltrate cryptographic keys. To preserve evidence for potential judicial proceedings while adhering strictly to forensic standards, which of the following actions should the analyst perform FIRST?

Cevabı ve açıklamayı göster

Cevap: Capture the host physical RAM using a validated live hardware or kernel-level acquisition mechanism directly to write-blocked local target media prior to changing system power states or network connectivity.

Cevap

Capture the host physical RAM using a validated live hardware or kernel-level acquisition mechanism directly to write-blocked local target media prior to changing system power states or network connectivity.
The correct action is to acquire system RAM live using a validated hardware or kernel acquisition method writing directly to local write-blocked media. System memory (RAM) is near the top of the Order of Volatility. Because memory-resident rootkits exist primarily in volatile memory, any alteration of system power states (such as a system shutdown) destroys the primary evidence.

Adım Adım Çözüm

1
Evaluate the evidence types present in the scenario based on the Order of Volatility.
System RAM and CPU registers represent the most volatile state, whereas static disk images are significantly less volatile.
Volatile evidence is lost immediately if system power is interrupted or modified.
2
Determine the proper acquisition sequence for a memory-resident kernel attack.
Acquire physical memory live while the system is powered on using hardware or dedicated kernel tools.
Powering down or restarting the host clears system RAM and destroys the volatile rootkit artifacts.
3
Apply write-blocking and local storage protocols during memory dump collection.
Save the memory image directly to isolated, write-blocked external storage.
Prevents altering system storage or transmitting artifacts over untrusted network connections that could corrupt the evidentiary chain.

Anahtar Kavram

Order of Volatility and Volatile Memory Acquisition
Tahmini Süre:3m 0s
Soru 218Soru →

A security analyst confirms that an internal user workstation is infected with active malware that is attempting to communicate with an external command-and-control server. According to standard incident response lifecycle frameworks (such as NIST SP 800-61), which of the following actions should the analyst take immediately after confirming the incident?

Cevabı ve açıklamayı göster

Cevap: Isolate the compromised workstation from the local network segment.

Cevap

Isolate the compromised workstation from the local network segment.
Isolating the affected system from the network is the essential initial containment step. It prevents lateral movement and external command-and-control communication while preserving system state for analysis.

Adım Adım Çözüm

1
Identify the current phase of the Incident Response lifecycle.
The incident has just been confirmed during the Detection and Analysis phase.
Determining the current phase dictates the appropriate immediate objective.
2
Determine the next sequential phase in standard frameworks (such as NIST SP 800-61).
The immediate next phase is Containment, Eradication, and Recovery, beginning with Containment.
Containment limits the scope of damage and prevents the malware from spreading or exfiltrating data.
3
Select the action corresponding to containment.
Network isolation of the host isolates the threat while allowing further analysis.
Isolating the workstation stops network transmission without destroying volatile forensic evidence on the host.

Anahtar Kavram

Incident Response Lifecycle Phase Order (NIST SP 800-61)
Soru 219Soru →

During an incident response investigation involving suspected database exfiltration on a live cloud-hosted virtual server, a security analyst must preserve system evidence while maintaining strict chain of custody compliance for potential legal proceedings. Which of the following procedures should the analyst perform immediately following the acquisition of the system's volatile memory?

Cevabı ve açıklamayı göster

Cevap: Generate a cryptographic hash digest of the captured memory file and record the hash, timestamp, and analyst identity in the custody log.

Cevap

Generate a cryptographic hash digest of the captured memory file and record the hash, timestamp, and analyst identity in the custody log.
In digital forensics, establishing evidence integrity requires calculating a cryptographic hash (e.g., SHA-256) immediately after image acquisition. Logging the resulting hash along with acquisition details, timestamps, and investigator credentials establishes a verified chain of custody ensuring the evidence remains untampered.

Adım Adım Çözüm

1
Acquire volatile RAM image
Volatile evidence preserved from the live virtual instance.
RAM contains perishable artifacts such as active connections, running processes, and decrypted keys.
2
Generate a cryptographic hash of the memory image
Creates a unique digital fingerprint (e.g., SHA-256 checksum) of the original evidence file.
Establishes a baseline integrity reference to prove the evidence has not been modified.
3
Document transfer in the chain of custody log
Records date, time, practitioner identity, hardware details, and hash digest.
Ensures complete traceability and legal admissibility of evidence from collection through court presentation.

Anahtar Kavram

Forensic Evidence Integrity and Chain of Custody Documentation
Tahmini Süre:2m 0s
Soru 220Soru →

An enterprise Incident Response Team (IRT) detects unauthorized DNS redirection caused by ARP cache poisoning on a critical core network segment. According to standard NIST SP 800-61 incident response frameworks, in what order should the incident response team execute the following operational response steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence follows the standard NIST incident response lifecycle: 1) Preserve evidence during Detection and Analysis, 2) Isolate the attack source during Containment, 3) Purge malicious tools and flush caches during Eradication, 4) Restore operations with monitoring during Recovery, and 5) Perform a lessons-learned review during Post-Incident Activity.
The standard incident response process requires systematically moving through Detection and Analysis (capturing volatile evidence), Containment (blocking rogue switch ports and applying static ARP mappings), Eradication (clearing poisoned ARP tables and deleting malicious scripts), Recovery (restoring standard network behavior under monitoring), and Post-Incident Activity (updating playbooks and holding a lessons-learned meeting).

Adım Adım Çözüm

1
Detection & Analysis Evidence Preservation
Network packet captures and volatile RAM are safely preserved without disturbing system artifacts.
Forensic evidence preservation is critical before taking intrusive isolation actions that could alter volatile memory state.
2
Containment
The rogue device's switch port is disabled and static ARP mappings temporarily halt active man-in-the-middle redirection.
Immediate containment prevents further scope expansion and stops unauthorized traffic interception.
3
Eradication
Malicious ARP spoofing tools are removed from compromised systems, and poisoned ARP tables across subnet hosts are cleared.
Eradication eliminates the threat vector and removes corrupted state from the environment.
4
Recovery
Normal dynamic network services are restored while heightened traffic logging verifies system health.
Recovery safely returns infrastructure to operational status under close monitoring to detect any persistence.
5
Post-Incident Activity
A formal lessons learned report is drafted and Network Access Control (NAC) policies are updated.
Post-incident activities complete the lifecycle by enhancing organizational security posture against future attacks.

Anahtar Kavram

NIST SP 800-61 Incident Response Lifecycle Phases
ÖncekiSayfa 11 / 32Sonraki