Examkin

Security Operations

627 soru

Tüm türler627Çoktan seçmeli320Çoklu seçim139Eşleştirme36Sıralama132
Soru 361Soru →

A security analyst is implementing an incident response playbook following a confirmed unauthorized access event on an internal code repository server. Arrange the following incident response actions in the correct chronological sequence according to standard NIST SP 800-61 guidelines, from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence is: (1) Analyze SIEM event logs and system artifacts, (2) Revoke compromised credentials and isolate the affected server, (3) Re-image the repository server from a clean baseline, and (4) Document the incident timeline and update policies.
According to the NIST SP 800-61 incident response framework, the lifecycle follows a strict sequence: Detection and Analysis, Containment, Eradication and Recovery, and Post-Incident Activity (Lessons Learned). Analyzing logs identifies the breach scope first, followed by isolating the server and revoking compromised credentials to contain the threat. Once contained, the server is re-imaged and restored during eradication and recovery. Finally, root-cause documentation and policy updates are conducted during post-incident lessons learned.

Adım Adım Çözüm

1
Perform Detection and Analysis
Identify the vector of unauthorized access and determine affected scopes by analyzing log sources.
Before containing an incident, analysts must confirm the nature and extent of the threat.
2
Execute Containment
Halt lateral movement and exfiltration by isolating host systems and revoking compromised credentials.
Containment limits damage while preventing the attacker from maintaining active sessions.
3
Perform Eradication and Recovery
Re-image compromised systems with verified clean media and safely restore services.
Eradication removes threat components, while recovery restores systems to operational status safely.
4
Conduct Post-Incident Activity
Conduct a lessons learned review, create documentation, and implement preventative control updates.
Post-incident review helps improve future response capabilities and fixes systemic vulnerabilities.

Anahtar Kavram

NIST Incident Response Lifecycle Sequential Phases
Soru 362Soru →

A Security Operations Center (SOC) analyst receives an EDR behavioral alert indicating an unauthorized persistence script running on an internal database host. In what order should the analyst execute the following actions to effectively contain, triage, and remediate the incident using EDR capabilities?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins with isolating the endpoint network traffic, stopping active malicious processes, collecting volatile forensic data, conducting root-cause process tree analysis, and deploying enterprise-wide IOC block rules.
The standard incident response containment sequence for EDR workflow mandates immediate host-level network isolation (to stop lateral spread), followed by process termination (to stop active execution), volatile evidence capture (for forensics), root-cause analysis via process lineage telemetry, and enterprise policy updating (to enforce long-term mitigation).

Adım Adım Çözüm

1
Isolate the compromised endpoint from the network via EDR.
Prevents lateral movement and C2 traffic while maintaining EDR management channels.
Containment is the primary objective upon identifying active endpoint compromised activity to limit blast radius.
2
Terminate malicious process lineage.
Stops ongoing execution of payload and persistence scripts.
Halting execution prevents further system alteration or memory dumping attempts.
3
Capture live memory and volatile forensic artifacts.
Gathers live memory dump and volatile state evidence.
Preserving volatile evidence prior to analysis ensures complete forensic coverage.
4
Perform root cause analysis using EDR telemetry.
Identifies initial execution vector and compromised user context.
Tracing process lineage reveals how the threat bypassed initial controls.
5
Distribute updated EDR policy rules and block lists enterprise-wide.
Enforces enterprise hardening against identified hashes and behavioral indicators.
Prevents identical attacks across other endpoints in the organization.

Anahtar Kavram

EDR Incident Containment and Investigation Lifecycle
Tahmini Süre:1m 30s
Soru 363Soru →

A security analyst in a Security Operations Center (SOC) receives a high-severity telemetry alert on a database server containing highly sensitive customer data. Analysis of the process execution lineage reveals that an attacker successfully loaded a vulnerable signed kernel driver (BYOVD attack) to blind local auditing tools and disable host firewall rules, subsequently initiating outbound C2 connections over non-standard encrypted ports. Which of the following actions leveraging Endpoint Detection and Response (EDR) features should the analyst execute FIRST to contain the active breach while preserving forensic evidence?

Cevabı ve açıklamayı göster

Cevap: Apply host network isolation via the EDR management console while leaving the EDR agent communication channel intact.

Cevap

The analyst should apply host network isolation via the EDR management console while preserving agent communication channels.
Applying host network isolation via the EDR console immediately blocks all incoming and outgoing network traffic at the host level while leaving the EDR control plane active. This isolates the threat, prevents lateral movement and exfiltration, and maintains volatile memory intact for incident investigation.

Adım Adım Çözüm

1
Identify the immediate operational objective
Contain active adversary activity and prevent lateral movement or C2 exfiltration without destroying volatile memory.
Active adversary activity must be contained immediately before eradication or detailed investigation takes place.
2
Evaluate EDR containment mechanisms
EDR network isolation drops all non-essential endpoint traffic while preserving low-level EDR agent communications to the cloud/management console.
This allows incident responders to execute remote forensic triage and live response scripts without allowing the attacker to communicate outward or move laterally.
3
Select the optimal response action
Enforce host isolation via the EDR console.
Host isolation meets both containment and evidence preservation requirements.

Anahtar Kavram

EDR Host Isolation and Telemetry Containment
Soru 364Soru →

An identity and access management administrator must execute the standard offboarding workflow upon an employee's immediate departure. Arrange the operational deprovisioning steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct deprovisioning sequence begins with verifying the HR notification, immediately revoking active SSO sessions and tokens, disabling the user account in directory services, stripping entitlements and reassigning data ownership, and finally archiving logs for compliance retention.
The correct sequence aligns with IAM operational best practices for offboarding: verifying authorization (HR notice), immediately revoking active sessions/tokens to stop ongoing access, disabling directory accounts to prevent new logins, revoking group entitlements and reassigning asset ownership, and finally archiving audit records for compliance.

Adım Adım Çözüm

1
Verify termination notification
HR authorization confirmed
Authorized IAM operational workflows must be triggered by verified administrative input.
2
Revoke active sessions and tokens
Ongoing access terminated
Active tokens must be revoked first to prevent a user from continuing existing application sessions.
3
Disable root directory entry
New authentications blocked
Disabling the directory entry blocks new login attempts across all integrated domain services.
4
Strip group rights and transfer assets
Permissions cleared and ownership transferred
Removing entitlements cleans up access rights while asset transfer ensures business continuity.
5
Archive identity logs and metadata
Audit history retained securely
Final archiving preserves evidence and meets regulatory requirements.

Anahtar Kavram

Account Lifecycle Management and Offboarding Operations
Soru 365Soru →

A security operations engineer is investigating an access issue where a newly provisioned systems administrator can successfully log in via SAML 2.0 Single Sign-On (SSO) to an enterprise cloud portal, but receives an HTTP 403 Forbidden error whenever attempting to open the database administration dashboard. The Identity Provider (IdP) SAML assertion log contains the following snippet:

xml
<saml:AttributeStatement>
<saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/department">
<saml:AttributeValue>Database_Admins</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>

However, the dashboard Service Provider (SP) policy configuration requires an attribute claim key named `roles` with a value of `db-admin-access` to grant rights.

Which of the following identity and access management operational issues BEST describes the root cause of this access failure?

Cevabı ve açıklamayı göster

Cevap: Authentication succeeded at the Identity Provider, but authorization failed at the Service Provider due to a claim attribute mapping mismatch.

Cevap

Authentication succeeded at the Identity Provider, but authorization failed at the Service Provider due to a claim attribute mapping mismatch.
In federated identity operations using SAML 2.0, authentication (verifying identity at the Identity Provider) and authorization (granting rights at the Service Provider) are distinct operations. The user successfully authenticated via SSO, but because the SAML assertion payload sent the attribute key 'department' instead of the SP's required claim key 'roles', the Service Provider could not map the user to the required authorization role, resulting in an HTTP 403 Forbidden response.

Adım Adım Çözüm

1
Analyze the authentication log snippet from the Identity Provider (IdP).
The IdP log confirms successful SAML SSO authentication and demonstrates that the user identity was issued an attribute named 'department' with value 'Database_Admins'.
Verifying IdP logs confirms whether the authentication phase of AAA was completed.
2
Compare the IdP attribute payload against the Service Provider (SP) authorization requirements.
The SP expects a claim key of 'roles' with value 'db-admin-access', but receives 'department' with value 'Database_Admins'.
Authorization decisions depend on exact match of requested and configured claims.
3
Determine the operational root cause.
Authentication succeeded (who the user is), but authorization failed (what permissions the user has) due to mismatched SAML attribute mappings.
Distinguishing authentication from authorization highlights why valid user credentials can still result in HTTP 403 access denial.

Anahtar Kavram

Separation of Authentication and Authorization in SAML SSO Attribute Mapping
Soru 366Soru →

Match each telemetry log snippet to the corresponding security event or attack vector.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

192.168.1.105 - - [27/Jul/2026:14:22:01] "GET /products.php?id=1%20UNION%20SELECT%201,username,password%20FROM%20users-- HTTP/1.1" 200 4521
Jul 27 14:25:03 auth-srv sshd[4102]: Failed password for root from 198.51.100.42 port 49152 ssh2 (repeated 150 times in 30s)
EventID: 4624, LogonType: 10, TargetUserName: Admin_svc, WorkstationName: DESKTOP-7K9L2, IpAddress: 203.0.113.15
Jul 27 14:30:12 fw-edge firewall: DENY TCP src=192.168.1.50 dst=10.0.0.5 dst_port=445 flags=SYN (threshold exceeded: 5000 pkts/sec)

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Log entry 1 matches SQL injection; Log entry 2 matches SSH brute-force; Log entry 3 matches RDP remote interactive logon; Log entry 4 matches SMB traffic burst scanning.
Each log archetype displays distinct key indicators: database commands inside HTTP query strings signify SQL injection; repeated rapid SSH password failures indicate brute-force login attempts; Event ID 4624 with LogonType 10 represents RDP remote logins; and high-volume blocked TCP 445 packets represent SMB scanning.

Adım Adım Çözüm

1
Analyze web access log parameters
Identify HTTP query string containing 'UNION SELECT 1,username,password FROM users--', confirming SQL injection.
Web server logs capture HTTP parameters that expose malicious payload structures.
2
Inspect authentication server syslog entries
Identify 150 failed password attempts within 30 seconds for root over SSH.
High frequency of failed SSH logons points directly to automated brute-force attacks.
3
Evaluate Windows Event ID and LogonType attributes
Confirm EventID 4624 with LogonType 10 corresponds to Remote Desktop Protocol (RDP) sessions.
LogonType 10 specifically designates RemoteInteractive access in Windows Security event logs.
4
Review firewall drop rules and destination ports
Associate DENY TCP traffic targeting port 445 in high bursts with SMB port scanning or automated lateral movement probes.
TCP port 445 is utilized for Server Message Block (SMB) services.

Anahtar Kavram

SIEM Log Pattern Recognition and Event Analysis
Tahmini Süre:1m 30s
Soru 367Soru →

A security engineer must execute a break-glass procedure to access a critical database server during an unannounced service disruption. Place the operational steps of the Privileged Access Management (PAM) emergency account lifecycle in the correct sequential order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational order for the PAM break-glass account lifecycle is: Submit an emergency checkout request referencing the incident ticket ID -> Complete out-of-band MFA approval -> Obtain temporary credentials and perform emergency maintenance -> Check in the emergency account in the PAM portal -> Execute automated credential rotation and terminate residual sessions.
The correct sequence adheres to enterprise PAM operational controls: establishing audit tracking via ticket reference, verifying identity through out-of-band MFA, executing emergency work with checked-out credentials, formally checking in the account, and executing automated credential rotation with session invalidation to guarantee single-use policy enforcement.

Adım Adım Çözüm

1
Initiate the emergency checkout request with ticket authorization.
The PAM vault logs the access intent with auditing details attached.
Establishing auditability and ticketing context must precede credential disclosure.
2
Authenticate via secondary out-of-band MFA.
The identity of the requesting administrator is verified.
Strong authentication prevents unauthorized break-glass credential releases.
3
Retrieve credential and conduct emergency remediation.
System maintenance is performed using the break-glass account.
Administrative tasks are executed only after successful authentication and checkout.
4
Check in the emergency account within the PAM portal.
The administrative window closes in the PAM tracking system.
Explicit check-in signals to the PAM solution that the account lifecycle controls should be triggered.
5
Automate password rotation and residual session termination.
The break-glass credential is replaced with a new random secret and open sessions are killed.
Automatic rotation ensures credentials used in emergency checkouts cannot be reused later.

Anahtar Kavram

Privileged Access Management (PAM) Break-Glass Account Lifecycle
Soru 368Soru →

A security operations team is configuring playbooks in a Security Orchestration, Automation, and Response (SOAR) platform to streamline incident triage and containment. Which of the following operational tasks are typically automated using SOAR playbooks? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Enriching incoming alert data by querying threat intelligence feeds via APIs; Executing API calls to perimeter firewalls to block malicious IP addresses

Cevap

Enriching incoming alert data with threat intelligence feeds and automatically issuing API commands to firewalls for IP containment are standard SOAR playbook functions.
SOAR platforms excel at orchestrating tools and automating repetitive incident response workflows. Querying external threat intelligence services via API to enrich SIEM alerts accelerates triage without human intervention. Similarly, executing pre-approved containment commands—such as calling a firewall API to block a malicious IP address—dramatically reduces mean time to respond (MTTR).

Adım Adım Çözüm

1
Identify the primary purpose of SOAR playbooks in security operations
SOAR playbooks automate repeatable triage, enrichment, and containment actions to reduce response times.
Automation focuses on programmatic tasks executed through integrations and APIs.
2
Evaluate each operational task against automated playbook capabilities
API queries to threat intelligence sources and automated API calls to firewalls to block IP addresses represent programmatic automation.
Strategic governance and structural network redesign require human decision-making and planning.

Anahtar Kavram

Security Automation and Orchestration (SOAR) Playbook Capabilities
Soru 369Soru →

A Security Orchestration, Automation, and Response (SOAR) platform is configured with an automated containment playbook that ingests high-severity SIEM alerts indicating Kerberoasting attacks. Upon detecting rapid requests for Service Principal Name (SPN) tickets, the playbook automatically revokes all active Kerberos tgt tokens and disables the associated Active Directory account. During a night-shift database backup, a critical core service account triggers a false-positive alert, causing automated account suspension that results in an enterprise-wide application outage. Which playbook modification best mitigates the operational risk while maintaining automated threat response capabilities?

Cevabı ve açıklamayı göster

Cevap: Insert a conditional decision node into the playbook that verifies an asset criticality allowlist and routes critical service accounts to a human-in-the-loop (HITL) approval step before disabling the account.

Cevap

Insert a conditional decision node into the playbook that verifies an asset criticality allowlist and routes critical service accounts to a human-in-the-loop (HITL) approval step before disabling the account.
Automated security response actions against critical operational assets carry severe risk of collateral damage. Introducing a conditional node based on asset tagging or allowlists allows the SOAR platform to apply immediate automated containment for standard endpoints while routing high-impact accounts (such as domain controllers or core service accounts) to a Human-in-the-Loop (HITL) manual approval step.

Adım Adım Çözüm

1
Analyze the operational incident root cause.
Unconditional automated suspension of critical service accounts led to a major business service outage.
Fully automated containment without asset sensitivity context creates high operational availability risk.
2
Evaluate SOAR playbook optimization strategies.
Distinguish between non-critical user accounts (fully automated containment) and mission-critical service accounts (human-in-the-loop oversight).
Conditional branching allows security teams to maintain high-speed automation where safe, while enforcing mandatory analyst verification for high-impact infrastructure assets.
3
Select the appropriate control architecture.
Integrating an allowlist check and human approval workflow balances containment speed with operational resilience.
This directly mitigates accidental service disruption during false positives or routine automated operations.

Anahtar Kavram

SOAR Playbook Design and Human-in-the-Loop (HITL) Governance
Soru 370Soru →

An incident response analyst is tasked with preserving digital evidence from a compromised application server during an active incident. In what sequence should the analyst perform the following forensic acquisition and custody actions to adhere strictly to the Order of Volatility and evidence handling protocols?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with capturing the most volatile artifacts (CPU registers and RAM), followed by dump files/swap space, then imaging non-volatile local storage, calculating cryptographic SHA-256 hashes of the images, and finally documenting the chain of custody log and sealing evidence.
Forensic evidence acquisition follows RFC 3227 guidelines: preserve the most volatile data first (CPU registers and main RAM), followed by temporary virtual memory (swap/pagefiles), non-volatile local disk storage, calculating cryptographic checksums (SHA-256) to establish baseline integrity, and completing the chain of custody log and physical tamper-evident sealing last.

Adım Adım Çözüm

1
Capture volatile RAM and registers
Preserves ephemeral system memory contents before power down or overwrite
Adheres to the Order of Volatility by securing the most volatile evidence first.
2
Dump swap space and pagefile memory
Preserves temporary virtual memory pages mapped to disk
Swap file data updates dynamically and ranks higher in volatility than static secondary storage.
3
Perform bit-stream imaging of local disk storage
Creates an exact bit-for-bit duplicate of non-volatile storage via write-blocker
Disk storage is non-volatile and must be captured without modifying original data.
4
Generate SHA-256 cryptographic hashes
Establishes a unique mathematical fingerprint for all forensic disk images
Enables future verification of evidence integrity and protects against tampering allegations.
5
Fill out chain of custody documentation
Records complete transfer history, custody control, and physical tamper-evident sealing
Ensures legal admissibility in court by tracking physical ownership and integrity metadata.

Anahtar Kavram

Order of Volatility and Chain of Custody Evidence Handling
Tahmini Süre:1m 30s
Soru 371Soru →

A Security Operations Center (SOC) team is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook to contain endpoints exhibiting active ransomware encryption behavior. During testing, an automated containment playbook executed on a Domain Controller following a false-positive detection, causing enterprise-wide service disruptions. Which modification to the SOAR playbook logic best balances rapid automated containment with operational risk management for critical infrastructure?

Cevabı ve açıklamayı göster

Cevap: Insert a conditional decision node that routes host isolation actions for critical asset tags to an analyst manual approval step while automatically isolating non-critical endpoints.

Cevap

The correct modification is to insert a conditional decision node that routes host isolation actions for critical asset tags to an analyst manual approval step while automatically isolating non-critical endpoints.
The correct choice implements asset-aware conditional logic within the SOAR playbook. By checking asset tags prior to containment actions, non-critical endpoints can be isolated immediately at machine speed, whereas high-impact assets (such as Domain Controllers or core servers) require a human-in-the-loop approval step to verify the alert before taking disruptive isolation measures.

Adım Adım Çözüm

1
Analyze the operational impact of unconstrained automation on critical infrastructure.
Identified that auto-isolating critical systems like Domain Controllers based on unverified triggers introduces unacceptable business outage risks.
SOAR playbooks must balance velocity of response with the operational risk of false positives.
2
Evaluate playbook decision logic modifications.
Adding contextual asset checks (e.g., checking asset tagging or CMDB data) enables granular workflows.
Criticality-aware playbooks can enforce different actions based on host importance.
3
Establish the optimal hybrid response mechanism.
Automate isolation for standard workstations and non-critical hosts, but gate isolation actions on critical servers behind human-in-the-loop analyst approval.
This maintains automated defense speed where acceptable while safeguarding enterprise availability.

Anahtar Kavram

SOAR Playbook Triage and Safe Automated Containment Logic
Soru 372Soru →

A security operations team reviews the following event logs from an enterprise Identity and Access Management (IAM) environment during an incident post-mortem:

text
[2026-07-27 14:02:11] RADIUS_AUTH: User 'j_doe' authenticated via EAP-TLS from IP 192.168.10.45. Assigned Role: Tier-1 Helpdesk.
[2026-07-27 14:05:30] PAM_VAULT: User 'j_doe' requested emergency break-glass checkout for 'sa_db_admin'. Approval: Automated (Ticket #9842).
[2026-07-27 14:05:31] TACACS_CMD: User 'j_doe' (as 'sa_db_admin') executed privileged command 'GRANT ALL PRIVILEGES ON prod_db.* TO 'j_doe'@'%''.
[2026-07-27 14:15:00] PAM_VAULT: Emergency break-glass session expired for 'sa_db_admin'. Password rotated automatically in Vault.
[2026-07-27 14:30:12] DB_AUDIT: User 'j_doe' logged into 'prod_db' directly from IP 10.200.5.12 using personal credentials with persistent global privileges.

Which of the following operational control failures allowed the user to maintain unauthorized database access after the Privileged Access Management (PAM) session expired?

Cevabı ve açıklamayı göster

Cevap: The break-glass operational policy permitted interactive command execution that altered target database access control lists directly, establishing an out-of-band persistent entitlement.

Cevap

The operational control failure occurred because the break-glass policy allowed interactive command execution that modified target database access control lists directly, creating an out-of-band persistent access path.
The correct answer identifies that the primary operational weakness was allowing unrestricted administrative command execution during a PAM break-glass session. When an administrative workflow lacks command blacklisting or change management integration, an operator can alter local access control lists (ACLs) to grant their unprivileged account persistent direct access. Even though the PAM system properly rotated the shared account credential upon expiration, the out-of-band permission modification on the database persisted.

Adım Adım Çözüm

1
Analyze the log timeline and user actions during the PAM session.
At 14:05:31, while using the break-glass account 'sa_db_admin', user 'j_doe' executed a SQL command granting global privileges to their personal user account ('j_doe'@'%').
Identifying what actions were taken during elevated session access reveals how persistence was created.
2
Evaluate the state of the PAM vault session termination at 14:15:00.
The PAM vault successfully terminated the break-glass session and automatically rotated the password for 'sa_db_admin'.
This confirms that the vault software functioned as designed regarding credential lifecycle management.
3
Correlate post-expiration access at 14:30:12 with the changes made in Step 1.
The user authenticated successfully using their standard personal account ('j_doe') because the database permission grant persisted independently of the vault credential status.
Without command filtering or continuous identity reconciliation (least privilege/ABAC enforcement), vault session teardowns cannot clean up out-of-band access control changes made on target resources.

Anahtar Kavram

Identity and Access Management Operations - Privileged Access Management and Lifecycle Control Governance
Tahmini Süre:2m 0s
Soru 373Soru →

A Security Operations Center (SOC) analyst is reviewing network intrusion detection system (NIDS) alerts monitoring an enterprise web application. The system generated an alert categorized as a Cross-Site Scripting (XSS) attempt after inspecting an HTTP request containing the payload `GET /login.php?user=admin' OR '1'='1'-- HTTP/1.1`. Which of the following best describes the analyst's evaluation of this alert?

Cevabı ve açıklamayı göster

Cevap: The alert is miscategorized because the payload represents a SQL injection attack attempting database query manipulation rather than client-side script execution.

Cevap

The alert is miscategorized because the payload represents a SQL injection attack attempting database query manipulation rather than client-side script execution.
The string `user=admin' OR '1'='1'--` is a signature of SQL injection, which targets backend relational database queries. Cross-Site Scripting (XSS) involves injecting client-side scripts (such as JavaScript) executed by the browser. Because the NIDS rule flagged a SQL injection vector as XSS, the analyst correctly evaluates the alert as miscategorized.

Adım Adım Çözüm

1
Examine the captured HTTP payload from the NIDS alert log snippet
Identified the query parameter payload `user=admin' OR '1'='1'--`.
Analyzing the specific payload characters is required to determine the true nature of the network activity.
2
Classify the payload type against attack vector definitions
Recognized `OR '1'='1'` as a database query manipulation string used in SQL injection attacks.
SQL injection targets database query syntax, while Cross-Site Scripting (XSS) relies on client-side script tags such as JavaScript.
3
Assess the NIDS rule mapping accuracy
Concluded that the monitoring signature mislabeled a backend SQL injection attempt as an XSS alert.
Accurate alert classification ensures correct incident handling and threat reporting.

Anahtar Kavram

Network Security Monitoring Alert Interpretation and Attack Classification
Soru 374Soru →

A security administrator must evaluate an operational technology (OT) network supporting critical infrastructure. The administrator needs to identify missing operating system patches and open ports without running tests that could potentially disrupt operations or crash sensitive services. Which type of vulnerability scan should the administrator perform?

Cevabı ve açıklamayı göster

Cevap: A non-intrusive scan

Cevap

A non-intrusive scan should be performed because it detects potential vulnerabilities without executing active exploit payloads or sending aggressive network traffic that could interrupt sensitive services.
Non-intrusive scanning identifies potential security weaknesses by checking host responses and software versions against known vulnerability signatures without executing invasive tests that could cause system failure.

Adım Adım Çözüm

1
Analyze the scenario requirements and operational constraints
The target environment contains sensitive operational technology devices where service downtime must be avoided.
Critical infrastructure systems are often sensitive to aggressive network probes and active exploitation tests.
2
Evaluate scanning methodologies against safety criteria
Select a non-intrusive scan.
Non-intrusive scans gather version information and inspect configuration parameters safely without risking system instability.

Anahtar Kavram

Non-intrusive vs. Intrusive Vulnerability Scanning
Soru 375Soru →

An EDR agent installed on a critical workstation flags a suspicious process spawned by a administrative command tool attempting to inject code into a system process. The threat actor is actively attempting lateral movement across the internal segment. Which of the following capabilities of the EDR system should be utilized FIRST to contain the threat while preserving telemetry for investigation?

Cevabı ve açıklamayı göster

Cevap: Initiate network isolation of the host from the EDR management console to block peer-to-peer communication while maintaining agent connection.

Cevap

Initiate network isolation of the host from the EDR management console to block peer-to-peer communication while maintaining agent connection.
Host network isolation capability in an EDR platform allows security operations teams to logically segment a compromised endpoint from all internal and external network resources instantly. The EDR agent maintains a dedicated communication channel to the cloud or on-premise EDR console, permitting analysts to collect forensic artifacts and execute remediation playbooks without risking lateral spread.

Adım Adım Çözüm

1
Analyze the incident context
Identified an active endpoint compromise with live lateral movement risk.
Process injection and lateral movement require immediate containment at the host level.
2
Select the appropriate EDR feature
Chose host network isolation provided directly by the EDR agent.
Host isolation disconnects host-to-host connectivity to stop lateral spread while allowing SOC analysts to maintain remote management access.

Anahtar Kavram

Endpoint Containment and Host Isolation in EDR
Tahmini Süre:1m 30s
Soru 376Soru →

A Security Operations Center (SOC) analyst receives an active EDR behavioral alert indicating that an unauthorized process executed `vssadmin.exe delete shadows /all /quiet` on an enterprise workstation and is actively attempting to encrypt files on connected SMB shares. Place the incident response actions in the correct chronological sequence to contain the threat and perform initial triage.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of actions is: 1) Initiate host-level network isolation through the EDR console, 2) Revoke active session tokens and disable compromised user account credentials, 3) Execute an EDR agent action to kill the malicious process tree and pull a volatile memory dump, and 4) Collect endpoint telemetry logs and sample payloads via EDR remote shell.
In EDR incident response, immediate containment takes precedence over investigation steps. Isolating the host via the EDR agent instantly restricts network connectivity and prevents lateral encryption across SMB shares without severing EDR console access. Next, revoking identity tokens prevents the attacker from using compromised credentials on other network hosts. Terminating the malicious process and capturing memory stops local damage and captures volatile evidence. Finally, collecting forensic logs enables root-cause analysis.

Adım Adım Çözüm

1
Isolate the host at the network layer via EDR console.
The endpoint is restricted from communicating with the broader network and network shares, halting encryption of remote assets.
Host isolation is the immediate priority during active ransomware behavior to prevent lateral movement while preserving EDR agent control.
2
Disable compromised account credentials and revoke active domain tokens.
Stolen credentials cannot be reused elsewhere in the environment.
Threat actors often pivot to other hosts using compromised account tokens if credentials are not invalidated immediately following host containment.
3
Terminate the malicious process tree and capture volatile system memory.
Ransomware file encryption stops on the local endpoint, and volatile memory is captured for analysis.
Stopping active malicious processes prevents further local damage, and capturing RAM before rebooting preserves injects and cryptographic keys.
4
Extract forensic artifacts and telemetry logs via EDR remote management capabilities.
Responders gain access to event logs, drop files, and execution timestamps.
Detailed forensic triage allows analysts to determine the initial access vector and develop enterprise-wide detection rules.

Anahtar Kavram

EDR Incident Containment and Response Workflow
Tahmini Süre:2m 0s
Soru 377Soru →

A security analyst is reviewing identity authentication logs and observes a user account successfully logging in from a corporate office in Chicago, followed by a second successful login using the same credentials from an IP address in London five minutes later. Which of the following operational security anomalies does this scenario best represent?

Cevabı ve açıklamayı göster

Cevap: Impossible travel indicating compromised credentials

Cevap

Impossible travel indicating compromised credentials
The scenario describes an impossible travel anomaly, which occurs when authentications for the same identity are recorded from two distant geographic regions within a duration shorter than the physical travel time required. This is a primary detective operational indicator that an adversary has harvested or purchased user credentials.

Adım Adım Çözüm

1
Analyze the timestamps and geographic locations provided in the log context.
The log entries record two successful authentications from Chicago and London occurring only five minutes apart.
Geographic distance between these cities cannot be traversed in five minutes by physical travel.
2
Correlate the log observation with standard IAM operational threat indicators.
Concurrent or near-simultaneous authentications from distant locations signify impossible travel, pointing to stolen user credentials.
Detecting impossible travel allows analysts to quickly flag and contain compromised user accounts.

Anahtar Kavram

Impossible Travel Anomaly Detection
Tahmini Süre:45s
Soru 378Soru →

A Security Operations Center (SOC) analyst receives a high-fidelity alert indicating that an internal workstation in the payroll department is establishing outbound DNS tunneling sessions to an unknown external IP address. Investigating the endpoint reveals active memory-resident scripts attempting to stage sensitive file archives. According to standard incident response frameworks, which of the following actions should the analyst take first?

Cevabı ve açıklamayı göster

Cevap: Disconnect the affected workstation from the network segment to isolate it.

Cevap

Disconnect the affected workstation from the network segment to isolate it.
The correct immediate action upon discovering an active threat communicating with an external malicious actor is containment. Disconnecting or network-isolating the affected workstation prevents ongoing data exfiltration and lateral spread without destroying volatile evidence stored in RAM.

Adım Adım Çözüm

1
Identify the current phase of the incident response lifecycle.
The incident is actively occurring with live command-and-control DNS tunneling, placing it squarely in the Containment phase.
Before performing analysis, cleanup, or restoration, active threat activity and data exfiltration must be stopped immediately.
2
Select the appropriate containment tactic.
Network isolation of the workstation prevents outbound communication and halts exfiltration while keeping volatile memory intact for forensics.
Containment limits the scope of damage without prematurely altering system state required for investigation.

Anahtar Kavram

Incident Response Lifecycle - Containment Phase
Soru 379Soru →

A security engineer is designing a vulnerability assessment strategy for a newly deployed microservices application hosted on short-lived container instances behind a web application firewall (WAF). Recent uncredentialed network-based vulnerability scans reported zero high-severity findings; however, a manual audit revealed several unpatched software dependencies and OS configuration flaws within the running container base images. Which of the following scanning approaches should the engineer implement to accurately detect these internal vulnerabilities without incurring high network overhead or triggering false negatives due to WAF filtering?

Cevabı ve açıklamayı göster

Cevap: Integrate container registry image scanning into the CI/CD deployment pipeline and deploy agent-based scanners within the base container templates.

Cevap

Integrating container registry image scanning into the CI/CD deployment pipeline and utilizing host/agent-based scanning within container base images accurately identifies internal software vulnerabilities without network overhead or WAF interference.
Integrating static image scanning into the CI/CD pipeline and deploying agent-based scanners directly inspects the container's internal file system, installed packages, and configuration files. This local assessment approach bypasses network firewalls, eliminates network latency, and reliably uncovers missing patches and misconfigurations regardless of container ephemeral lifespans.

Adım Adım Çözüm

1
Analyze the technical environment and current failure state
Uncredentialed network scanning failed to identify internal flaws due to container short lifespans, network isolation, and WAF inspection.
Network-based vulnerability scanners inspect exposed open network ports and services but cannot evaluate local package manifests or file permissions behind protective inline firewalls.
2
Evaluate candidate scanning methodologies against operational constraints
Agent-based scanning and pipeline container image analysis operate locally on the target operating system image and build artifacts.
Host-based agents and static image scanners access internal package managers (e.g., dpkg, rpm) directly, generating zero network scan traffic and avoiding WAF blockage.
3
Select the optimal vulnerability scanning architecture
CI/CD registry scanning paired with agent-based evaluation provides complete visibility into containerized microservice vulnerabilities.
This strategy satisfies all requirements by detecting local vulnerabilities prior to and during deployment without network degradation.

Anahtar Kavram

Credentialed and Agent-Based vs. Network-Based Vulnerability Scanning in Container Environments
Soru 380Soru →

During a security telemetry audit of a cloud-hosted perimeter network, a security analyst evaluates a high-priority incident generated by a Network Intrusion Detection System (NIDS). The event correlates an inbound HTTP POST request payload with subsequent anomaly alerts from outbound network flow logs.

Web Application Log Snippet:
http
POST /api/v1/login HTTP/1.1
Host: portal.example.com
Content-Type: application/x-www-form-urlencoded
Payload: user=admin' OR '1'='1'--&pass=unknown

NIDS & VPC Flow Telemetry Alert:
`[ALERT] Outbound session initiated from internal application node 10.0.4.15:443 to external IP 198.51.100.42:53421 following authentication bypass payload.`

The analyst categorizes the attack as a Cross-Site Scripting (XSS) attempt aimed at endpoint browsers and recommends deploying client-side script execution restrictions. Which of the following analytical errors did the analyst commit, and what is the correct network security monitoring response?

Cevabı ve açıklamayı göster

Cevap: The analyst misdiagnosed a SQL injection (SQLi) attack targeting database queries as Cross-Site Scripting (XSS); the network security monitoring rules should be updated with Web Application Firewall (WAF) deep packet inspection signatures to detect database payload manipulation.

Cevap

The analyst misdiagnosed a SQL injection attack targeting database queries as Cross-Site Scripting, and the correct monitoring action is deploying Web Application Firewall (WAF) deep packet inspection signatures.
The payload `user=admin' OR '1'='1'--` is a classic SQL injection vector that forces a database query to evaluate to true, bypassing authentication controls. The analyst incorrectly identified this as Cross-Site Scripting (XSS). Effective network security monitoring for web applications requires Layer 7 application inspection (such as a WAF or NIDS application ruleset) capable of examining HTTP POST bodies and triggering correlated alerts when suspicious payloads produce anomalous outbound traffic.

Adım Adım Çözüm

1
Analyze the web application log payload.
The payload `user=admin' OR '1'='1'--` uses SQL syntax to manipulate backend database logic and bypass authentication.
SQL Injection inserts SQL commands into data inputs, whereas XSS injects executable scripts (e.g., JavaScript) rendered by a user's web browser.
2
Evaluate the analyst's diagnostic conclusion.
The analyst committed a misdiagnosis error by classifying SQL injection as Cross-Site Scripting.
Remediating client-side script execution will not defend against backend database query manipulation.
3
Determine the appropriate network security monitoring control.
Implement Layer 7 inspection via Web Application Firewall (WAF) or NIDS signatures tuned for SQL syntax patterns.
Network security monitoring must operate at the application layer (Layer 7) to parse HTTP POST bodies and correlate them with outbound anomaly alerts.

Anahtar Kavram

Log Analysis and Network Intrusion Detection Signature Tuning for Web Application Attacks
ÖncekiSayfa 19 / 32Sonraki
Security Operations Alıştırma Soruları — CompTIA Security+ — Sayfa 19 | Examkin