Security Operations

627 soru

Tüm türler627 Çoktan seçmeli320 Çoklu seçim139 Eşleştirme36 Sıralama132

A Security Operations Center (SOC) analyst receives a high-severity alert from a Wireless Intrusion Prevention System (WIPS) indicating that an unauthorized rogue access point has been connected to an internal network switch port. Which of the following sequence of steps represents the correct order for responding to this incident according to standard incident response playbooks?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of incident response actions is: 1) Validate the alert by analyzing switch port logs and netflow data; 2) Logically isolate the affected switch port via network management tools; 3) Physically remove the unauthorized access point and update NAC policies; 4) Restore standard switch port settings and verify network telemetry; 5) Conduct a post-incident review to document lessons learned.

Standard incident response frameworks (such as NIST SP 800-61) define a strict sequential process: Detection and Analysis (validating the WIPS alert via switch logs), Containment (logically isolating the switch port), Eradication (physically removing the rogue AP and updating NAC rules), Recovery (restoring switch port operation safely and monitoring telemetry), and Post-Incident Activity (conducting a lessons learned review).

Adım Adım Çözüm

Perform Detection and Analysis

Confirmed rogue access point location and operational impact.

Before initiating containment or remediation, responders must analyze and validate the alert to verify an actual incident is taking place.

Implement Containment

Rogue access point network communication is disabled.

Isolating the switch port stops potential data exfiltration and unauthorized network access while preserving evidence.

Execute Eradication

Rogue hardware is physically removed and NAC controls are updated.

Eradication removes the root cause of the incident from the network architecture.

Perform Recovery

Switch port is securely re-enabled and monitored for clean operational status.

Recovery ensures affected infrastructure is returned to safe production operations with active monitoring.

Conduct Post-Incident Activity

Incident report created and physical security playbooks updated.

Lessons learned feed back into the incident response lifecycle to harden enterprise defenses against future incidents.

Anahtar Kavram

Incident Response Lifecycle Phases (NIST SP 800-61)

Tahmini Süre:1m 30s

Soru 322Soru →

An organization is establishing a secure onboarding process for system administrators to enforce least privilege and privileged access management (PAM). In what order should the administrative security operations team perform the following operational tasks during user onboarding?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins with identity verification via HR records, followed by provisioning a standard baseline account in the Identity Provider, then integrating the user into the Privileged Access Management solution, and concluding with enforcing Multi-Factor Authentication and conducting a final permission audit.

The correct sequence starts with identity verification against authoritative HR records to validate authorization. Next, a basic non-privileged account is created in the central Identity Provider to enforce least privilege. The account is subsequently registered in the Privileged Access Management (PAM) vault to manage temporary elevation securely. Finally, Multi-Factor Authentication (MFA) registration is completed and initial permissions are audited to finalize secure onboarding.

Adım Adım Çözüm

Identity Validation

HR authorization baseline confirmed.

Prevents unauthorized account creation by confirming employment and role requirements before generating directory objects.

Baseline Provisioning

Standard non-privileged account created.

Establishes a core user identity following least privilege principles prior to assigning elevated rights.

PAM System Integration

Identity linked to vault for just-in-time privilege checkouts.

Ensures administrative activities are subject to credential vaulting, session recording, and automated access revocation.

MFA Activation & Audit

Strong authentication registered and RBAC baseline verified.

Ensures multifactor security controls are operational and access limits are verified before granting access to systems.

Anahtar Kavram

Identity Lifecycle Management and PAM Onboarding Operations

Soru 323Soru →

An enterprise infrastructure security team is performing a post-incident audit across a hybrid multi-cloud environment. Log correlation reveals that a former cloud administrator whose Active Directory account was disabled during an automated offboarding process was still able to access confidential production storage buckets two days later:

[2026-07-25 09:00:00] AD_EVENT: User 'dev_admin_04' status updated to DISABLED via HR workflow.
[2026-07-25 09:01:15] SCIM_EVENT: Provisioning sync sent DELETE request for user GUID 'usr-99482' to Cloud IdP -> HTTP 200 OK.
[2026-07-27 14:10:22] API_GATEWAY: OAuth Token Refresh Request for Client ID 'App-Storage-v2' using Refresh Token 'rt_88dfa2...'.
[2026-07-27 14:10:23] CLOUD_IDP: Token Endpoint issued new Access Token 'at_44c12...' without re-evaluating directory account state.
[2026-07-27 14:11:05] STORAGE_SERVICE: GET /buckets/prod-finance-db -> HTTP 200 OK (Authenticated via 'at_44c12...').

Which of the following operational root causes BEST explains why the offboarded administrator retained API access despite successful SCIM deprovisioning, and what remediation should be implemented?

SCIM deprovisioning only revokes authentication credentials at the identity provider level but does not modify OAuth authorization scopes assigned to API resource servers; reconfiguring role-based access control policies on the API gateway is required.

SCIM functions strictly as a detective monitoring control to record lifecycle events rather than an automated preventive control capable of modifying user account states across federated identity providers.

The Identity Provider token endpoint issued a new access token because it validated the refresh token without checking real-time directory account status; revoking active refresh tokens upon offboarding and enabling Continuous Access Evaluation (CAE) is required.

The storage service is located within the enterprise internal network perimeter, which automatically trusts incoming API requests carrying valid authorization headers without verifying token revocation state against the IdP metadata endpoint.

Cevabı ve açıklamayı göster

Cevap: The Identity Provider token endpoint issued a new access token because it validated the refresh token without checking real-time directory account status; revoking active refresh tokens upon offboarding and enabling Continuous Access Evaluation (CAE) is required.

Cevap

The log analysis demonstrates that while SCIM successfully deprovisioned the user object in the Cloud Identity Provider, the user's previously issued long-lived OAuth refresh token remained active. When the API Gateway presented this refresh token, the token endpoint generated a new access token without performing a real-time check against the user's directory account status. To prevent unauthorized post-offboarding access, IAM operations must explicitly revoke active refresh tokens and user sessions upon termination, as well as deploy Continuous Access Evaluation (CAE) to enforce real-time access policy decisions.

Adım Adım Çözüm

Analyze the account deprovisioning log entries.

Active Directory disabled the user account and SCIM issued an automated DELETE call to the Cloud IdP, which returned HTTP 200 OK.

Confirms that account deprovisioning succeeded at both the primary directory level and the federated identity provider level.

Examine the OAuth token refresh event occurring two days post-offboarding.

The API Gateway presented a long-lived refresh token (`rt_88dfa2...`), and the Cloud IdP issued a new short-lived access token (`at_44c12...`) without re-evaluating whether the underlying directory user account was active.

Identifies that standard OAuth 2.0 token endpoints evaluate refresh token validity independently of live directory status unless active session revocation or real-time continuous evaluation is configured.

Determine the operational root cause and required security remediation.

The root cause is unrevoked refresh tokens combined with passive token validation. The required control remediation is revoking all active refresh tokens and user session state during offboarding, alongside implementing Continuous Access Evaluation (CAE).

Ensures that identity state changes are immediately propagated and enforced across token endpoints and API resource gateways in real time.

Anahtar Kavram

OAuth 2.0 Refresh Token Lifecycle, Session Revocation, and Continuous Access Evaluation (CAE)

Tahmini Süre:2m 0s

Soru 324Soru →

A security analyst is acquiring digital evidence from a running enterprise application server immediately after detecting an active intrusion. Place the evidence sources in sequence according to the standard order of volatility, starting with the MOST volatile evidence first and ending with the LEAST volatile evidence.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of volatility from most volatile to least volatile is: CPU cache and processor registers, followed by System RAM and ARP cache, Temporary swap space and pagefiles, Local solid-state drive (SSD) storage, and finally Offsite optical and magnetic backup tapes.

Digital forensics standards dictate capturing evidence in order of decreasing volatility to prevent data loss. CPU registers and cache memory vanish almost instantaneously, followed by system RAM and dynamic network tables, virtual memory swap files on disk, non-volatile local drives, and lastly offsite backup media.

Adım Adım Çözüm

Identify CPU hardware state as the highest priority.

CPU cache and processor registers are placed first.

Registers and processor cache are the most short-lived data structures in a computer system.

Prioritize main system RAM and active network cache.

System RAM and ARP cache are placed second.

Volatile memory contains running process code, cryptographic keys, and active network states that disappear on shutdown.

Order secondary virtual storage and local drives.

Temporary swap space and pagefiles are placed third, followed by local SSD storage fourth.

Swap files update dynamically during system runtime, while primary local disk storage retains persistent files.

Place long-term offline archives last.

Offsite optical and magnetic backup tapes are placed fifth.

Offline backup media is immutable and least susceptible to immediate modification or loss.

Anahtar Kavram

Order of Volatility

Tahmini Süre:1m 30s

Soru 325Soru →

A security analyst is investigating a alert generated by a SIEM correlation engine. The console displays the following sequential log entries collected from an enterprise web server and host database:

2026-07-27 11:05:12 | Host: WEB-01 | Apache: 192.168.1.105 - - "POST /login.php HTTP/1.1" 200 4512 "username=admin' OR '1'='1"
2026-07-27 11:05:13 | Host: WEB-01 | Auth: Successful authentication for user 'admin' from 192.168.1.105
2026-07-27 11:05:18 | Host: DB-01 | MySQL: Query executed: SELECT * FROM users WHERE username='admin' OR '1'='1'

Based on these correlated log entries, which of the following best describes the attack vector being executed and its immediate impact?

Cross-Site Scripting (XSS) executing malicious client-side scripts to hijack the active admin session.

SQL injection (SQLi) resulting in an authentication bypass by manipulating the backend database query logic.

A SIEM correlation rule misinterpretation that incorrectly combined unrelated legitimate administrative logins.

An authorization control failure where database access permissions were incorrectly assigned to an unauthenticated identity.

Cevabı ve açıklamayı göster

Cevap: SQL injection (SQLi) resulting in an authentication bypass by manipulating the backend database query logic.

Cevap

SQL injection (SQLi) resulting in an authentication bypass by manipulating the backend database query logic.

The HTTP POST request contains the classic SQL injection payload 'OR '1'='1, which forces the database conditional check to evaluate as true. As a result, the backend application authenticates the request as the 'admin' user without verifying credentials, leading to an authentication bypass.

Adım Adım Çözüm

Analyze the web server request payload in the Apache HTTP log.

The input string "username=admin' OR '1'='1" contains SQL syntax markers intended to alter database query logic.

Web logs reveal initial attack vectors and payload delivery.

Correlate web server authentication events with host database query logs.

The database executed `SELECT * FROM users WHERE username='admin' OR '1'='1'`, which evaluates to true for all rows, returning a valid admin record.

Evaluating downstream database behavior confirms if an input payload successfully altered application backend processing.

Determine the impact of the successful payload execution.

The web application granted a successful authentication session for 'admin' without requiring a valid password.

Connecting payload execution to log authentication outcomes identifies the threat type as SQL injection leading to authentication bypass.

Anahtar Kavram

SQL Injection (SQLi) Log Analysis

Soru 326Soru →

A system administrator is auditing user permissions following a departmental transfer. An employee moved from the Accounting department to Human Resources but still retains write access to the Accounting file share. Which of the following identity and access management operations should be executed to resolve this issue?

Conduct an access privilege review to adjust permissions in accordance with least privilege

Require the transferred employee to re-authenticate using multi-factor authentication

Place the employee's new workstation on an internal trusted network segment behind an enterprise firewall

Deploy a deterrent physical control at the entry door of the Accounting department

Cevabı ve açıklamayı göster

Cevap: Conduct an access privilege review to adjust permissions in accordance with least privilege

Cevap

Conducting an access privilege review to adjust permissions in accordance with the principle of least privilege.

An access privilege review allows security administrators to audit user entitlements following organizational changes, revoking obsolete rights so that access aligns with the principle of least privilege.

Adım Adım Çözüm

Identify the administrative gap

The employee maintains rights to resources no longer required for their updated job role.

Job transfers often lead to privilege creep if rights from previous roles are not explicitly revoked.

Select the appropriate IAM lifecycle process

Perform an access recertification/review.

Periodic or event-driven access reviews evaluate authorization boundaries to remove unneeded entitlements.

Anahtar Kavram

Account Lifecycle Operations & Privilege Recertification

Soru 327Soru →

An enterprise identity administrator is enforcing phishing-resistant multi-factor authentication (MFA) for privileged accounts. What is the correct sequence of events for registering a FIDO2 WebAuthn hardware security key with the Identity Provider (IdP)? Place the steps in chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct registration sequence begins with the IdP issuing a cryptographic challenge nonce to the client browser. Next, the user touches the hardware key to generate an origin-bound asymmetric key pair on the device. Then, the security key signs the challenge and returns the signature, public key, and attestation data to the IdP. Finally, the IdP validates the attestation statement and registers the public key to the user's IAM account profile.

The correct sequence follows the standard FIDO2/WebAuthn registration ceremony. First, the Identity Provider initiates the process by issuing a cryptographic challenge nonce to the browser. Second, upon user presence confirmation, the hardware token generates an origin-bound asymmetric key pair. Third, the token signs the challenge with the private key and returns the public key and attestation payload. Fourth, the Identity Provider verifies the attestation and signature before persisting the public key in the user's IAM profile.

Adım Adım Çözüm

Identify the initial server-side trigger.

The Identity Provider generates a cryptographic challenge nonce to prevent replay attacks during WebAuthn registration.

Challenge creation must occur first so that the hardware key has fresh data to sign.

Determine the local hardware token response.

The user completes physical presence verification (e.g., touch sensor), prompting the security key to generate an origin-bound public/private key pair.

The key pair is created on-device in response to the browser receiving the registration challenge.

Trace the transmission of cryptographic proof.

The security key signs the challenge nonce using the private key and returns the signature, new public key, and attestation object to the IdP.

The IdP requires the signature and public key to verify authentic token hardware before enrollment.

Finalize identity binding at the Identity Provider.

The IdP authenticates the attestation metadata, verifies the signature against the issued challenge, and binds the public key to the user's IAM profile.

Saving the verified public key in the IAM user store is the final step required for future authentication.

Anahtar Kavram

FIDO2/WebAuthn Enrollment Ceremony and Cryptographic Credential Binding

Soru 328Soru →

A network security team receives a high-severity alert indicating anomalous telemetry from a critical database bridge host. An analyst inspects the correlated Network Flow (NetFlow) logs and DNS query events shown below:

The analyst notes that low-volume outbound encrypted connections occur at fixed 300-second intervals following short-TTL DNS queries for algorithmically generated subdomains. Which of the following mitigation actions should the security analyst perform FIRST to contain the threat while minimizing operational disruption to legitimate encrypted web services?

Implement Response Policy Zone (RPZ) DNS sinkholing for the malicious domain and configure egress TLS Server Name Indication (SNI) filtering on the web proxy.

Create an emergency perimeter firewall rule blocking all outbound traffic on destination TCP port 443 across the database bridge subnet.

Reclassify the alert as a false positive due to the standard port usage and small payload sizes typical of keep-alive signals.

Deploy an inline honeypot on port 443 within the database bridge subnet to automatically drop and inspect the outgoing packets.

Cevabı ve açıklamayı göster

Cevap: Implement Response Policy Zone (RPZ) DNS sinkholing for the malicious domain and configure egress TLS Server Name Indication (SNI) filtering on the web proxy.

Cevap

Implement Response Policy Zone (RPZ) DNS sinkholing for the malicious domain and configure egress TLS Server Name Indication (SNI) filtering on the web proxy.

The observed telemetry displays classic indicators of compromised host C2 beaconing: regular timing intervals (300 seconds), uniform low byte size (142 bytes), and dynamic DNS lookups with low TTLs. Employing DNS sinkholing (RPZ) combined with proxy-level SNI filtering precisely disrupts the malicious C2 channel without taking down legitimate outbound HTTPS access on port 443.

Adım Adım Çözüm

Analyze flow and log telemetry indicators

Identified periodic outbound HTTPS connections (every 300 seconds) with fixed 142-byte payloads to an external IP resolved via short-TTL dynamic DNS, confirming malware C2 beaconing.

Recognizing command and control beaconing behavior isolates the precise threat mechanism.

Evaluate candidate mitigation controls for precision and operational impact

Determined that DNS sinkholing via RPZ combined with SNI proxy filtering specifically isolates and redirects malicious communications without impacting unrelated business HTTPS traffic.

Effective security controls must mitigate targeted threats while preserving availability for legitimate services.

Select the optimal initial containment step

Selected domain-specific sinkholing and SNI-based egress filtering as the preferred first-line containment strategy.

This approach disrupts C2 reachability immediately with minimal risk of broad service outage.

Anahtar Kavram

Network Security Monitoring Alert Analysis and Command & Control (C2) Beacon Containment

Soru 329Soru →

During security operations monitoring, an analyst receives an alert indicating anomalous API token creation and unexpected mass repository downloads originating from a compromised developer endpoint connected via VPN. The analyst confirms that an external threat actor is actively leveraging these stolen credentials to access private source code repositories. According to NIST incident response guidelines, which of the following immediate actions should the incident response team perform during the Containment phase of this incident? (Select TWO)

Geçerli olan tümünü seçin

Revoke active VPN sessions and invalidate all API tokens associated with the compromised developer account.

Re-image the compromised developer workstation and restore repository data from the latest validated backup.

Apply restrictive host-based firewall rules to isolate the affected workstation while preserving volatile system memory for analysis.

Conduct a lessons learned meeting with management to update internal credential management policies.

Cevabı ve açıklamayı göster

Cevap: Revoke active VPN sessions and invalidate all API tokens associated with the compromised developer account.; Apply restrictive host-based firewall rules to isolate the affected workstation while preserving volatile system memory for analysis.

Cevap

The correct containment actions are revoking the active VPN sessions and invalidating stolen API tokens associated with the account, as well as applying host-based firewall rules to isolate the compromised endpoint while preserving volatile memory.

During the containment phase of an incident response process, the goal is to prevent the threat from spreading or causing further damage while preserving forensic evidence. Revoking compromised credentials and API tokens stops the attacker from continuing exfiltration, while network-isolating the host prevents lateral movement while preserving volatile system RAM for forensic investigation.

Adım Adım Çözüm

Identify the primary phase of the incident response lifecycle requested in the scenario.

The scenario specifically asks for actions appropriate for the Containment phase of the NIST SP 800-61 IR framework.

Containment limits the scope and impact of an active breach before recovery steps begin.

Evaluate containment actions that immediately halt adversary activity without destroying digital evidence.

Revoking active credentials/tokens stops ongoing unauthorized remote access. Isolating the workstation network interface prevents lateral movement while retaining volatile RAM data.

Effective containment balances stopping threat activity with evidence preservation.

Distinguish containment phase actions from eradication, recovery, or post-incident activities.

Actions such as re-imaging hosts or holding lessons learned sessions belong to later IR phases.

Prematurely re-imaging hosts destroys forensic evidence before containment and investigation are complete.

Anahtar Kavram

NIST Incident Response Containment Phase Strategies

Soru 330Soru →

A Security Operations Center (SOC) analyst is reviewing an automated response playbook triggered by an Endpoint Detection and Response (EDR) agent following a suspected credential dumping attack against a high-value server. In what chronological sequence should the EDR agent and SOC workflow execute these actions to contain the threat and preserve forensic evidence?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence is: 1) Detect anomalous API memory read requests targeting LSASS, 2) Enforce host-level software network isolation, 3) Capture a volatile memory dump and terminate the offending process tree, and 4) Query tenant-wide EDR telemetry to identify other impacted endpoints.

The sequence follows the core EDR lifecycle: Detection must precede response; host-level network isolation must be established immediately after detection to block lateral spread; volatile memory collection and process termination follow isolation to safely remediate the host; and tenant-wide telemetry correlation occurs last to assess broader enterprise compromise.

Adım Adım Çözüm

Identify initial threat activity.

The EDR behavioral monitor alerts on unauthorized memory access to sensitive system processes.

Detection provides the trigger for automated playbook execution.

Isolate the compromised system.

Host-based firewall rules block all inbound/outbound communication except EDR management connections.

Containment limits adversary lateral movement while keeping SOC visibility intact.

Acquire evidence and eradicate host execution.

Physical memory artifacts are saved to disk, followed by process tree termination.

Preserving volatile RAM prior to or simultaneously with process termination ensures critical memory-resident indicators are retained.

Perform enterprise scope analysis.

Telemetry indicators from the alert are cross-referenced across all enterprise endpoints.

Broader threat hunting ensures full scope eradication across the enterprise domain.

Anahtar Kavram

EDR Automated Containment and Incident Response Workflow Sequence

Soru 331Soru →

A security analyst conducts both a credentialed host vulnerability assessment and a non-credentialed network scan against a critical Linux database server. The non-credentialed network scan reports zero critical vulnerabilities, whereas the credentialed scan identifies multiple unpatched kernel vulnerabilities and weak local file permissions. Additionally, internal host firewalls on the server are configured to drop ICMP and block unauthenticated port probing from outside the local management subnet. Which of the following best explains the discrepancy between the two scan results?

The host firewall filtered the non-credentialed scanner's network probes, and non-credentialed scans lack the local OS permissions required to audit internal patch levels and configuration files.

The credentialed scan executed active exploit payloads to verify vulnerability exploitability, whereas non-credentialed scans are restricted to passive network traffic monitoring.

Non-credentialed vulnerability scanners evaluate target systems exclusively via static source code analysis (SAST) rather than probing running network services.

The non-credentialed scanner mistakenly identified Cross-Site Scripting (XSS) vulnerabilities on the host as database SQL injection false positives.

Cevabı ve açıklamayı göster

Cevap: The host firewall filtered the non-credentialed scanner's network probes, and non-credentialed scans lack the local OS permissions required to audit internal patch levels and configuration files.

Cevap

The host firewall filtered the non-credentialed scanner's network probes, and non-credentialed scans lack the local OS permissions required to audit internal patch levels and configuration files.

The option explaining that the host firewall filtered network probes while non-credentialed scans lack local OS permissions is correct. Credentialed scans log into the operating system using valid account privileges to audit internal configurations, installed packages, kernel versions, and local user rights. Non-credentialed scans view the target solely from the network perspective; if network traffic is blocked by firewalls or ACLs, or if vulnerabilities are internal to the OS configuration, non-credentialed scans will produce false negatives.

Adım Adım Çözüm

Analyze the operational difference between credentialed and non-credentialed vulnerability scans.

Credentialed scans authenticate to the host OS using administrative credentials to inspect local files, registries, and patch status. Non-credentialed scans only examine network-exposed ports, banners, and services.

Understanding scan context determines what visibility each scanner type possesses.

Evaluate the impact of the target server's host firewall configuration.

The host firewall drops unauthenticated probes, causing the non-credentialed network scanner to see closed/filtered ports and miss running services.

Network filtering prevents non-credentialed scanners from reaching listening services or gathering banner information.

Synthesize why the credentialed scan successfully uncovered unpatched kernel flaws and weak permissions.

Because the credentialed scan authenticated locally, it bypassed network firewall restrictions and directly queried local system state (kernel version, patch history, and file system permissions).

Local system access provides complete visibility regardless of perimeter network controls.

Anahtar Kavram

Credentialed vs. Non-Credentialed Vulnerability Scanning

Tahmini Süre:2m 0s

Soru 332Soru →

An IAM administrator at an enterprise health system is conducting emergency offboarding for a compromised account. The administrator disables the user's account in the on-premises Active Directory. However, an hour later, security operations detects ongoing unauthorized administrative API calls performed in the cloud SaaS platform using that identity. Upon reviewing the SCIM bridge synchronization logs, the analyst observes the following log entries:

[2026-07-27 14:02:11] WARN scim_sync_engine: PATCH /Users/usr_88291 HTTP/1.1 429 Too Many Requests - Rate limit exceeded. Account deprecation push failed.
[2026-07-27 14:02:11] INFO scim_sync_engine: Exponential backoff retry scheduled for 14,400 seconds.
[2026-07-27 14:15:00] AUDIT saas_api_gateway: Token authentication successful for usr_88291 via Bearer JWT. Active session valid.

Which of the following operational remediation actions should the analyst take FIRST to immediately terminate the unauthorized active cloud session?

Revoke active OAuth 2.0/JWT access and refresh session tokens directly within the cloud SaaS administrative portal.

Manually force an immediate full sync on the SCIM bridge connector to overwrite the rate-limiting backoff timer.

Reset the compromised user's password in the on-premises Active Directory to force token re-validation.

Deploy an emergency block rule on the edge firewall targeting the outbound destination IP addresses of the cloud SaaS platform.

Cevabı ve açıklamayı göster

Cevap: Revoke active OAuth 2.0/JWT access and refresh session tokens directly within the cloud SaaS administrative portal.

Cevap

Revoke active OAuth 2.0/JWT access and refresh session tokens directly within the cloud SaaS administrative portal.

Directly revoking the active OAuth 2.0/JWT session and refresh tokens within the cloud SaaS administrative portal is the most direct and immediate operational control to kill the compromised session. Because the SCIM provisioning bridge failed due to HTTP 429 rate limiting, relying on automated account disabling will take up to four hours (the scheduled backoff period). Explicit session revocation invalidates the bearer token at the cloud gateway immediately.

Adım Adım Çözüm

Analyze the log entries to identify the root cause of ongoing unauthorized access.

The SCIM synchronization bridge failed to push the disabled account status to the cloud provider due to HTTP 429 rate limiting, leaving the account active in the cloud while an active JWT bearer token remained valid.

Stateless authentication tokens (JWTs) remain valid until expiration or explicit token revocation at the API gateway/identity provider.

Evaluate containment actions for immediate session termination.

Directly revoking session tokens inside the SaaS portal terminates active sessions immediately without waiting for automated provisioning sync retries.

Token revocation is the primary operational response for terminating active session hijackings or compromised identity tokens.

Anahtar Kavram

Identity Lifecycle Operations and Active Session Revocation

Tahmini Süre:2m 0s

Soru 333Soru →

During a routine audit of enterprise endpoint logs, a threat hunter discovers an unauthorized, memory-resident process running on an HR file server that is actively sending encrypted outbound beacons to a suspicious external IP address. Initial investigation confirms an active Command and Control (C2) connection. According to standard incident response frameworks, which of the following actions should the security team take FIRST?

Disconnect the infected HR file server from the network segment to prevent lateral movement while maintaining system power to preserve volatile RAM.

Re-image the server hard drives using clean gold-master images and restore user data from the most recent backup set.

Conduct a post-incident review meeting with HR stakeholders to update the organization's incident response playbooks.

Deploy updated antivirus signatures across all enterprise endpoints to block the malware payload.

Cevabı ve açıklamayı göster

Cevap: Disconnect the infected HR file server from the network segment to prevent lateral movement while maintaining system power to preserve volatile RAM.

Cevap

The security team should first disconnect the infected file server from the network segment to contain the threat while keeping power connected to preserve volatile memory.

According to the NIST Incident Response lifecycle (Preparation, Detection & Analysis, Containment, Eradication & Recovery, Post-Incident Activity), the immediate priority upon confirming an active compromise is containment. Network isolation prevents the attacker from exfiltrating data or moving laterally, while keeping the machine powered preserves volatile memory (RAM) necessary for memory forensics.

Adım Adım Çözüm

Identify the current incident response phase

The incident is transitioning from detection and analysis to the containment phase due to active C2 traffic.

Once an active compromise is confirmed, immediate containment is required to halt communication and lateral movement.

Determine the appropriate immediate containment action

Network isolation stops outbound C2 beacons and prevents lateral propagation while leaving the system powered on preserves volatile memory (RAM) for analysis.

Standard NIST SP 800-61 incident response guidelines require containment before eradication and recovery steps can proceed safely.

Anahtar Kavram

Incident Response Lifecycle Phases and Containment Strategies

Soru 334Soru →

An EDR console triggers a high-severity behavioral alert on an enterprise application server after detecting an obfuscated PowerShell execution that attempts process injection into a legitimate system process and initiates an outbound connection to an unknown external IP address. Which of the following initial containment and investigation actions should the security analyst perform directly using EDR console capabilities? (Select TWO.)

Geçerli olan tümünü seçin

Apply host-level network isolation to the endpoint while maintaining management channel connectivity.

Kill the malicious process tree and capture a volatile memory dump for forensic analysis.

Push an updated static virus signature file to enterprise endpoints via legacy antivirus definitions.

Reconfigure the perimeter firewall to drop all inbound and outbound traffic for the target subnet.

Cevabı ve açıklamayı göster

Cevap: Apply host-level network isolation to the endpoint while maintaining management channel connectivity.; Kill the malicious process tree and capture a volatile memory dump for forensic analysis.

Cevap

The analyst should isolate the host endpoint from the network while preserving EDR management communications and terminate the suspicious process tree while capturing volatile memory for investigation.

Isolating the endpoint network traffic while retaining agent communication stops malicious lateral movement without severing SOC management, and terminating process trees alongside volatile memory acquisition halts code execution while preserving volatile evidence.

Adım Adım Çözüm

Initiate network isolation on the affected endpoint

Prevents lateral movement and command-and-control communication while leaving the EDR management channel active.

Containment is the immediate priority during an active process injection incident.

Terminate malicious processes and collect volatile memory telemetry

Stops malicious payload execution and captures RAM data required for memory analysis.

Preserves forensic evidence before process termination or host modification.

Anahtar Kavram

Endpoint Detection and Response (EDR) Host Isolation and Process Containment

Tahmini Süre:1m 30s

Soru 335Soru →

Following an alert indicating that an unauthorized process attempted to dump LSASS memory on a corporate workstation, a security analyst needs to prevent the compromised host from communicating with internal network assets while preserving the host's active connection to the central EDR console for remote incident triage. Which of the following capabilities should the analyst execute?

Host network isolation

Edge firewall rule modification

Static antivirus signature update

Deception honeypot deployment on the local subnet

Cevabı ve açıklamayı göster

Cevap: Host network isolation

Cevap

Host network isolation is the appropriate EDR capability to stop lateral movement while retaining agent communication for incident triage.

Host network isolation configures the local software driver or agent to block all network traffic to and from the host, with an exception for the encrypted control channel to the EDR management platform. This effectively stops lateral movement across the enterprise while enabling security analysts to perform remote triage, memory dumps, and remediation actions.

Adım Adım Çözüm

Identify containment objectives during an active host compromise

The host must be restricted from communicating with other internal network systems.

Preventing lateral movement limits the spread of post-exploitation activities across the enterprise.

Evaluate EDR features that isolate endpoints while retaining management control

Host network isolation applies software-defined filtering at the endpoint level, dropping user-space and local network traffic while keeping the EDR telemetry socket open.

Security operations teams require uninterrupted telemetry access to collect volatile data and execute response playbooks remotely.

Anahtar Kavram

Endpoint Detection and Response (EDR) Host Network Isolation

Tahmini Süre:1m 0s

Soru 336Soru →

During an active incident investigation on an enterprise Linux application server, an incident responder detects suspicious process execution originating from a kernel module. The server remains powered on and connected to the internal network segment. To preserve evidence while minimizing the loss of transient data, which of the following actions should the analyst perform FIRST according to the order of volatility?

Capture the system RAM using a specialized live memory acquisition tool.

Power down the system immediately and make a bit-stream copy of the storage drive.

Generate a cryptographic hash of the active system log files directly on the live file system.

Encrypt the primary storage partition using a newly generated asymmetric public key.

Cevabı ve açıklamayı göster

Cevap: Capture the system RAM using a specialized live memory acquisition tool.

Cevap

The incident responder should capture the system RAM using a specialized live memory acquisition tool prior to acquiring non-volatile storage or altering system state.

Capturing system RAM using a live acquisition tool is the correct initial action because volatile memory contains temporary process states, network connections, and loaded kernel modules that are permanently erased when the machine is shut down. According to the order of volatility, memory collection must precede persistent drive imaging.

Adım Adım Çözüm

Identify the volatility level of candidate evidence sources.

System RAM and CPU registers are categorized as highly volatile, while local disk storage and network logs are far less volatile.

The order of volatility dictates collecting the most transient data first before it is modified or permanently lost.

Perform live acquisition of volatile memory.

A memory dump image is saved to secure external storage.

Preserving running processes, kernel structures, and active connections requires live RAM capture before system power state alterations occur.

Calculate and record cryptographic hashes of the memory dump file.

Integrity baseline is established for chain of custody tracking.

Ensures that acquired forensic artifacts can be validated against subsequent modifications during legal proceedings.

Anahtar Kavram

Order of Volatility in Digital Forensics

Soru 337Soru →

A Security Operations Center (SOC) analyst wants to standardize and automate the incident response steps for phishing alerts. The workflow needs to automatically extract suspicious URLs, query threat intelligence sources, and isolate affected endpoints without manual intervention. Which SOAR component should the analyst configure to execute this automated sequence of actions?

A security playbook

A SIEM log correlation rule

A threat intelligence data feed

An identity authentication gateway

Cevabı ve açıklamayı göster

Cevap: A security playbook

Cevap

A security playbook is the SOAR component used to execute automated, multi-step incident response workflows.

A security playbook is a automated linear or conditional script used by SOAR platforms to orchestrate incident response processes across connected systems. It allows SOC teams to automate repeated tasks such as extracting indicators, querying threat feeds, and isolating compromised hosts.

Adım Adım Çözüm

Identify the primary operational requirement in the scenario.

The requirement is to define and execute an automated sequence of multi-tool actions (triage, threat lookup, endpoint isolation).

Understanding the goal distinguishes detection mechanisms from automation and orchestration mechanisms.

Evaluate the capabilities of Security Automation and Orchestration (SOAR).

SOAR uses playbooks (or runbooks) to codify step-by-step incident response workflows into executable logic using APIs.

Playbooks provide the automated conditional logic required to coordinate tasks across distinct security tools.

Anahtar Kavram

SOAR Playbooks and Automated Response

Soru 338Soru →

An analyst receives an automated intrusion detection alert indicating suspicious outbound traffic from a workstation. Place the initial network security monitoring and triage steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence is: First, validate the initial network alert to verify whether it represents a real event or false positive; second, examine relevant packet captures and netflow logs to determine the scope; third, isolate the affected workstation from the network; fourth, document the monitoring findings and notify the incident response team.

Effective network security monitoring follows a structured workflow: alert triage and validation must happen first, followed by telemetry inspection to scope the incident, host isolation to contain risk, and finally thorough documentation and incident escalation.

Adım Adım Çözüm

Alert Validation

Confirmed genuine alert requiring investigation.

Before acting on an alert, security analysts must rule out false positives.

Telemetry & Log Analysis

Identified destination IP address and traffic volume.

Reviewing packet captures and network flows helps identify the exact nature and extent of the threat.

Host Containment

Workstation disconnected from local subnet.

Preventing lateral movement or exfiltration is critical once suspicious activity is confirmed and scoped.

Documentation & Escalation

Alert ticket updated and escalated to tier-2 incident response.

Proper documentation ensures complete chain-of-custody and smooth operational handoff.

Anahtar Kavram

Network Security Monitoring Triage & Incident Workflow

Soru 339Soru →

A security operations center (SOC) detects an active compromise of an administrative account with elevated privileges across hybrid cloud infrastructure. To contain the incident and restore secure identity operations according to privileged access management (PAM) best practices, place the mitigation and lifecycle remediation steps in the correct chronological sequence.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational order for containing and remediating a compromised privileged account is: First, terminate active sessions and invalidate tokens at the IdP; second, trigger an automated SCIM push to revoke downstream federated SaaS access; third, rotate vaulted credentials within the PAM solution; fourth, perform an IGA entitlement recertification audit.

In security operations, incident containment prioritizes immediate threat suppression: active session termination and token invalidation at the IdP stop ongoing adversary actions. Once centralized sessions are severed, automated SCIM provisioning pushes account disablement to downstream federated services. Next, secrets stored in the PAM vault are rotated to prevent credential reuse. Finally, IGA recertification cleanses unauthorized entitlement changes made by the threat actor.

Adım Adım Çözüm

Perform immediate active session containment

Active adversary connections are terminated and access tokens are invalidated at the centralized Identity Provider.

Containment must occur at the root IdP level before attackers can pivot or establish additional persistence mechanisms.

Synchronize account disablement across federated environments

SCIM protocol updates disable state across external Service Providers (SPs).

Relying solely on central IdP disablement without SCIM or continuous access evaluation (CAE) can leave active SaaS sessions functional until refresh tokens expire.

Rotate administrative secrets and vault baseline credentials

All static and dynamic passwords, API keys, and certificates associated with the compromised account are refreshed in the PAM vault.

Vault rotation ensures that harvested credentials cannot be reused to re-authenticate after sessions are killed.

Execute post-incident Identity Governance and Administration (IGA) recertification

All granted entitlements, group memberships, and role assignments are audited and reconciled against authorization baseline policies.

IGA recertification verifies that persistence mechanisms, such as unauthorized role assignments created during the incident, are completely removed.

Anahtar Kavram

Identity Lifecycle and Incident Response Containment in IAM Operations

Soru 340Soru →

Match each vulnerability assessment scan type to its defining operational characteristic.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Credentialed Scan pairs with using system-level privileges for internal inspection; Non-Credentialed Scan pairs with unauthenticated external probing of exposed services; Passive Scan pairs with silently monitoring traffic flow without sending probes; Intrusive Scan pairs with executing tests that risk system instability or service disruption.

Each vulnerability scan type aligns with its specific operational profile: credentialed scans access host interiors using privileges, non-credentialed scans inspect external attack surfaces without privileges, passive scans collect intelligence from network traffic without packet injection, and intrusive scans run aggressive tests that may disrupt target availability.

Adım Adım Çözüm

Identify the authentication level of the scan types.

Credentialed scans use local privileges for deep inspection, whereas non-credentialed scans simulate unauthenticated external observers.

Differentiating authentication capabilities clarifies internal inventory auditing versus surface attack view.

Analyze the operational impact and network traffic generation of the remaining scan types.

Passive scans capture existing traffic without transmitting data, while intrusive scans actively interact with vulnerabilities and risk causing service outages.

Understanding network traffic generation helps separate non-interfere monitoring from high-impact active testing.

Anahtar Kavram

Vulnerability assessment scan classifications (Credentialed, Non-Credentialed, Passive, Intrusive)

ÖncekiSayfa 17 / 32Sonraki

Security Operations

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram