Security Operations

An incident investigation team is analyzing correlated telemetry captured by an enterprise SIEM from an API Gateway (APIGW) and an Identity Provider (IDP):

text
2026-03-14T08:12:01Z [APIGW] src_ip=198.51.100.44 method=POST uri="/api/v1/auth/login" status=200 user="j_doe"
2026-03-14T08:12:05Z [IDP] user="j_doe" auth_method="MFA_TOTP" status="SUCCESS" src_ip=198.51.100.44
2026-03-14T08:12:12Z [APIGW] src_ip=198.51.100.44 method=GET uri="/api/v1/admin/export" status=403 user="j_doe" error="InsufficientPrivileges"
2026-03-14T08:12:18Z [APIGW] src_ip=198.51.100.44 method=POST uri="/api/v1/users/j_doe/roles" status=200 payload="{\"add_role\":\"GlobalAdmin\"}"
2026-03-14T08:12:25Z [APIGW] src_ip=198.51.100.44 method=GET uri="/api/v1/admin/export" status=200 user="j_doe" bytes_sent=4194304

Based on the log sequence above, which of the following security events occurred?

A Security Operations Center (SOC) team is configuring an automated Endpoint Detection and Response (EDR) incident response workflow to handle host-based malicious script execution. In what sequence should the EDR platform execute the containment, mitigation, and post-incident investigation actions?

Following an EDR telemetry alert indicating an active credential-harvesting attempt on a Windows domain controller, a SOC analyst must execute an incident response procedure. In what sequence should the analyst execute the following actions to effectively contain the threat, preserve evidence, and remediate the endpoint?

An incident responder is preparing to collect digital evidence from a powered-on corporate workstation suspected of compromise. According to standard forensic evidence collection guidelines (Order of Volatility), in what sequence should the responder capture the following components, from MOST volatile to LEAST volatile?

Following the detection of suspicious command-and-control beaconing, an enterprise incident response team completes short-term network isolation of a compromised hypervisor host managing critical cloud workloads. The analyst verifies that lateral movement has been halted and containment boundaries are holding. According to standard NIST incident response lifecycle guidelines, which action should the incident response team execute NEXT before initiating eradication procedures?

Following a high-severity alert indicating unauthorized root-level execution on a enterprise hypervisor server, a security analyst is assigned to preserve digital evidence from the active physical host. Which of the following initial steps must the analyst perform to preserve evidence integrity and adhere to forensic best practices? (Select TWO.)

A security analyst is investigating a compromised cloud-hosted Linux virtual machine suspected of participating in an ongoing data exfiltration attack. To ensure proper digital forensics and maintain legal defensibility, which of the following actions should the analyst perform during initial evidence acquisition? (Select TWO).

A Security Operations Center (SOC) analyst is reviewing raw log telemetry streams collected from web servers, authentication systems, and perimeter firewalls inside a SIEM environment. Match each log snippet pattern on the left with its corresponding attack vector or security event classification on the right.

A Security Operations Center (SOC) analyst receives a high-severity alert indicating that a powershell process on an internal endpoint is performing process injection into system memory. The analyst needs to immediately contain the active threat and prevent potential lateral movement across the internal network while maintaining remote administrative management to investigate the endpoint. Which of the following actions performed via an Endpoint Detection and Response (EDR) agent best achieves this goal?

A security analyst discovers that a developer's API key was publicly exposed in a code repository and is actively being used by an unauthorized external entity to read data from a cloud storage bucket. According to standard incident response playbooks, which of the following immediate CONTAINMENT steps should the analyst take? (Select TWO.)

A digital forensics investigator takes possession of a storage drive seized during an internal security investigation. What is the primary purpose of completing a chain of custody document for this evidence?

During a threat hunting exercise on an enterprise Linux application server hosting a mission-critical web service, a security analyst analyzes host telemetry. While network perimeter security controls inspect traffic as encrypted HTTPS over TCP port 443, the Endpoint Detection and Response (EDR) agent captures a process creation event where the primary web service daemon spawned an unauthorized bash shell, which subsequently loaded an obfuscated binary payload into volatile shared memory (`/dev/shm`). The analyst must halt the active command-and-control (C2) session and eradicate the malicious code execution immediately without causing downtime for legitimate external application users. Which of the following capabilities provided by the EDR platform should the analyst utilize to accomplish this objective?

A security analyst is designing an enterprise vulnerability assessment strategy for a network that includes legacy operational technology (OT) control systems, web applications, and sensitive database servers. The analyst must achieve maximum vulnerability visibility while minimizing the risk of unexpected service disruptions or system crashes. Which of the following technical scanning approaches should the security team implement to meet these requirements? (Select TWO.)

A Security Operations Center (SOC) analyst detects an active, verified security incident where an adversary is utilizing a compromised internal jump server to maintain an unauthorized encrypted SSH tunnel to an external command-and-control IP address. The analyst has confirmed that sensitive data is actively being transferred across this channel. According to standard incident response lifecycle frameworks, which of the following actions should the analyst take FIRST?

Match each security log entry or SIEM telemetry event to the attack vector or operational activity it most accurately demonstrates.

A cloud incident handler detects active unauthorized API activity within a production cloud tenant. Investigation reveals that a developer accidentally committed an administrative API key to a public code repository, allowing an external threat actor to deploy unauthorized compute instances and initiate unauthorized data export jobs. The handler has verified the malicious activity in the cloud provider's audit logs. According to standard incident response lifecycle guidelines, which of the following actions should the handler take FIRST to contain the threat?

During an active incident response investigation involving an enterprise server suspected of executing malware in memory, a technician is instructed to power down the server immediately and pull the primary storage drive to generate a bit-stream disk image prior to capturing any system RAM or running processes. Which digital forensics principle is directly violated by executing this instruction?

A security engineer is reviewing correlated telemetry in a SIEM console containing the following web application firewall (WAF) and database audit events:

text
2026-07-27T14:15:02Z waf01 http_request client_ip=198.51.100.44 uri="/api/v1/catalog" status=200 payload="' UNION SELECT username, password_hash FROM accounts--"
2026-07-27T14:15:02Z db01 query_exec db_user="app_service" query="SELECT * FROM products WHERE category = '' UNION SELECT username, password_hash FROM accounts--'" rows_returned=1420

Which of the following attack vectors was successfully executed against the application based on these log entries?

A security analyst takes possession of a physical hard drive seized during a breach investigation. Which of the following actions must the analyst take to maintain a valid chain of custody and preserve evidence integrity? (Select TWO.)

During an security incident, an incident response team has successfully isolated an infected enterprise application server from the internal network. According to standard incident response lifecycle frameworks, which of the following actions represents the primary goal of the eradication phase?