Examkin

Security Operations

627 soru

Tüm türler627Çoktan seçmeli320Çoklu seçim139Eşleştirme36Sıralama132
Soru 421Soru →

During network security monitoring of a segmented cloud environment, an analyst receives an automated Network Intrusion Detection System (NIDS) alert indicating that an internal deception host (honeypot) has initiated outbound network connections toward an unknown external address. A team member suggests modifying network routing policies to use this honeypot host as an inline security filter for all outbound enterprise traffic to block unauthorized connections. Which of the following best explains why this recommendation represents a fundamental misunderstanding of network monitoring and deception controls?

Cevabı ve açıklamayı göster

Cevap: Honeypots are designed purely as threat intelligence and detective monitoring tools, not inline preventive traffic-filtering mechanisms.

Cevap

Honeypots are designed purely as threat intelligence and detective monitoring tools, not inline preventive traffic-filtering mechanisms.
Deception technologies, such as honeypots, are specialized detective security controls placed in network environments to lure attackers, detect unauthorized access attempts, and capture threat intelligence. Because any traffic interacting with a honeypot is inherently suspicious, these assets are strictly isolated and monitored passively. They are not production gateways or inline filtering systems, and routing legitimate enterprise network traffic through them introduces severe security risks and operational degradation.

Adım Adım Çözüm

1
Analyze the role of the security asset identified in the alert.
The target asset is a honeypot (deception technology) within a monitored network segment.
Honeypots have no legitimate production duties and exist strictly to detect, trap, and monitor unauthorized interactions.
2
Evaluate the proposed operational change.
Routing production outbound traffic through a honeypot treats a detective deception control as an inline preventive firewall.
Honeypots are not hardened or designed to function as high-throughput inline filtering gateways for production environments.
3
Select the option that correctly contrasts deception controls with inline filtering.
The correct response highlights that honeypots function as detective and intelligence-gathering tools rather than inline filtering appliances.
Proper security architecture distinguishes passive detective monitoring tools from active preventive traffic-filtering controls.

Anahtar Kavram

Honeypot Functionality vs. Inline Defense Controls
Tahmini Süre:1m 30s
Soru 422Soru →

A cybersecurity analyst is configuring an automated incident response playbook within a Security Orchestration, Automation, and Response (SOAR) platform to process high-severity credential dumping alerts triggered by Endpoint Detection and Response (EDR) agents. To effectively contain potential lateral movement without introducing catastrophic operational downtime to enterprise operations, which of the following playbook logic designs should be implemented?

Cevabı ve açıklamayı göster

Cevap: Apply automated host isolation to standard workstation alerts while routing alerts involving Tier-0 infrastructure, such as domain controllers, to a Human-in-the-Loop (HITL) manual approval gate before containment.

Cevap

Implement conditional branching that executes automated network isolation on standard endpoints while enforcing a Human-in-the-Loop (HITL) manual authorization step for critical Tier-0 infrastructure.
The correct option correctly implements conditional branching and Human-in-the-Loop (HITL) governance in SOAR workflows. Isolating standard endpoints immediately limits credential abuse and lateral movement, whereas requiring analyst verification for Tier-0 assets (like domain controllers) mitigates the risk of automated service denial across the enterprise.

Adım Adım Çözüm

1
Analyze the impact of automated SOAR containment actions on enterprise assets.
Unchecked automated isolation of Tier-0 systems like domain controllers can cause widespread outages and operational disruption.
SOAR playbooks must balance velocity of response with risk management.
2
Design conditional logic within the SOAR workflow.
Standard endpoints receive immediate automated containment to halt lateral movement, while critical servers trigger an analyst notification for manual intervention.
Human-in-the-Loop (HITL) approval prevents false-positive automated outages on key systems.

Anahtar Kavram

SOAR Playbook Logic and Operational Risk Management
Soru 423Soru →

A security analyst is setting up an automated Security Orchestration, Automation, and Response (SOAR) playbook to streamline initial response tasks when a suspicious email attachment is reported. Which of the following tasks are most appropriate for full automation without requiring human-in-the-loop approval? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Submitting the suspicious attachment hash to external threat intelligence feeds for automated reputation scoring; Isolating the affected recipient workstation from the internal network using integrated endpoint protection tools

Cevap

The actions appropriate for full automation are querying external threat intelligence feeds for hash reputation scoring and isolating the recipient workstation via endpoint security controls.
Automating reputation lookups with threat intelligence feeds allows rapid risk assessment without operational risk. Similarly, isolating a single workstation prevents lateral movement of suspected fileless or payload-based malware while keeping containment tightly targeted.

Adım Adım Çözüm

1
Identify non-disruptive enrichment workflows suitable for SOAR playbooks.
Automated hash reputation lookup against threat intelligence sources enriches alert telemetry safely.
Enrichment tasks are read-only and do not affect business operations.
2
Identify targeted containment controls for individual endpoint protection.
Host isolation via Endpoint Detection and Response (EDR) limits lateral threat movement.
Host isolation protects the broader network while targeting only the potentially compromised machine.

Anahtar Kavram

SOAR Playbook Automation and Enrichment
Tahmini Süre:1m 0s
Soru 424Soru →

An incident response team is responding to a confirmed security incident involving unauthorized API key usage and data exfiltration from an enterprise cloud storage bucket. Place the following incident response actions in the correct sequential order from first step to last step according to standard incident response playbooks.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence follows the standard NIST incident response framework: Detection & Analysis (analyzing audit logs to scope the incident), Containment (revoking access keys and locking down storage access), Eradication & Recovery (deleting backdoor IAM roles and restoring secure baseline permissions), and Post-Incident Activity (holding a lessons-learned retrospective and updating playbooks).
The standard incident response process flows sequentially through four main phases: Detection & Analysis, Containment, Eradication & Recovery, and Post-Incident Activity. First, analyzing audit logs establishes incident scope (Detection & Analysis). Second, revoking compromised access keys halts ongoing exfiltration (Containment). Third, deleting unauthorized backdoor roles and restoring baseline permissions removes threat persistence and restores secure operations (Eradication & Recovery). Finally, conducting a post-incident retrospective documents lessons learned (Post-Incident Activity).

Adım Adım Çözüm

1
Perform Detection & Analysis
Validate the security event and establish the full scope of compromised cloud resources using audit log analysis.
Before executing containment, responder actions must be guided by verified scope and threat intelligence.
2
Execute Containment strategy
Disable compromised access credentials and restrict bucket access policies to prevent further data loss.
Containment limits damage and prevents the adversary from continuing unauthorized data exfiltration.
3
Perform Eradication & Recovery
Purge any secondary backdoor roles installed by the attacker and return cloud environment permissions to a verified clean state.
Eradication removes all mechanisms of adversary persistence, while recovery restores systems to normal production status.
4
Conduct Post-Incident Activity
Document timeline, evaluate incident response performance, and update playbooks to improve future defense capabilities.
Lessons learned activities occur post-remediation to prevent recurrence and enhance operational readiness.

Anahtar Kavram

NIST Incident Response Lifecycle Phases
Soru 425Soru →

A Security Operations Center (SOC) analyst receives an Endpoint Detection and Response (EDR) telemetry alert indicating a malicious DLL side-loading attempt on an enterprise domain controller. Arrange the standard EDR incident response steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of actions is: 1) Detect and flag the behavioral anomaly via EDR telemetry, 2) Apply host-level network isolation, 3) Collect volatile memory snapshots and execution logs, and 4) Terminate malicious processes, remove persistence keys, and restore network connectivity.
The correct order follows the standard incident containment life cycle: telemetry detection identifies the threat, host isolation immediately contains lateral movement while maintaining EDR management channels, forensic collection gathers volatile evidence safely, and remediation cleans the system before network restoration.

Adım Adım Çözüm

1
Identify threat activity using EDR behavioral monitoring telemetry
Alert generated for unauthorized process execution and side-loading
Detection provides the necessary diagnostic context to initiate incident response.
2
Isolate the endpoint using host-level network containment
Host is logically disconnected from the network while preserving EDR control
Containing the host mitigates lateral spread and C2 communication immediately.
3
Gather forensic artifacts and volatile memory captures via EDR console
Volatile evidence is preserved without risking network exposure
Collecting triage data while isolated ensures evidence is captured prior to system modification.
4
Remediate threat artifacts and lift host network isolation
Rogue processes killed, persistence removed, and endpoint restored to normal operations
Remediation and un-isolation conclude the active containment and response lifecycle.

Anahtar Kavram

EDR automated containment and forensic investigation workflow
Tahmini Süre:1m 30s
Soru 426Soru →

A network administrator needs to monitor enterprise traffic volumes, protocol distributions, and IP communication pairs across internal routers without inspecting or storing packet payloads. Which of the following monitoring mechanisms should the administrator implement?

Cevabı ve açıklamayı göster

Cevap: NetFlow flow telemetry collection

Cevap

NetFlow flow telemetry collection is the correct mechanism because it captures network session metadata (source/destination IPs, ports, and transfer sizes) across network devices without storing full packet payloads.
NetFlow flow telemetry collection gathers lightweight session metadata—including source and destination IP addresses, ports, protocol types, and byte counts—from network devices. It allows security analysts to observe network traffic statistics across the enterprise without the overhead of full packet payload capture.

Adım Adım Çözüm

1
Identify the core requirement from the scenario.
The requirement is to track network traffic volume, protocols, and IP communication pairs across routers without storing packet payloads.
Understanding the monitoring requirements narrows down full packet capture versus flow-based telemetry mechanisms.
2
Evaluate the capabilities of network flow technologies.
NetFlow/IPFIX aggregates traffic metadata (headers, byte counts, session durations) at router interfaces without payload recording.
Flow data provides high-level visibility across broad network infrastructure with minimal storage overhead.

Anahtar Kavram

Network Flow Monitoring (NetFlow/IPFIX)
Tahmini Süre:45s
Soru 427Soru →

A security analyst is conducting a routine audit of Identity and Access Management (IAM) operational logs following an employee offboarding procedure. The log analysis reveals that an offboarded engineer's primary user account was disabled in Active Directory immediately upon termination. However, three days later, successful interactive logins were recorded on several internal servers using a secondary administrative account assigned to the same individual. Which of the following identity management operational failures is the MOST likely root cause of this security gap?

Cevabı ve açıklamayı göster

Cevap: Incomplete account lifecycle deprovisioning across secondary and privileged identities.

Cevap

Incomplete account lifecycle deprovisioning across secondary and privileged identities.
Comprehensive identity lifecycle management requires all accounts associated with an individual—including primary, secondary, and privileged administrative accounts—to be promptly identified and deprovisioned during employee offboarding. Leaving secondary accounts active creates orphaned accounts that present critical security vulnerabilities.

Adım Adım Çözüm

1
Analyze the incident details from the IAM operational log audit.
Identified that while the primary user account was disabled during offboarding, a secondary administrative account assigned to the same user remained active.
Offboarding procedures must track and revoke all identities linked to an individual.
2
Evaluate the cause of the unauthorized post-offboarding logins.
The logins succeeded because valid credentials for the secondary account were still active in the environment.
Orphaned accounts resulting from partial deprovisioning remain fully functional for authentication.
3
Determine the operational failure responsible for the security gap.
The root cause is incomplete identity lifecycle management during account deprovisioning.
Effective IAM operations require comprehensive account inventory and complete deprovisioning workflows across all user identities.

Anahtar Kavram

Identity Lifecycle Management and Account Deprovisioning Operations
Soru 428Soru →

An enterprise security team is configuring a Just-In-Time (JIT) Privileged Access Management (PAM) workflow with short-lived ephemeral credentials for database administrators. Place the operational lifecycle steps in the correct chronological order from the initial access request through session termination.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The operational sequence begins with administrator authentication and request submission, followed by automated policy validation and ephemeral credential generation, session initiation through the PAM proxy gateway, real-time command monitoring and session recording during operation, and concludes with automated credential revocation and session termination upon time window expiry.
The correct operational lifecycle follows the principle of least privilege and Just-In-Time access controls. It starts with the administrator requesting access with justification. Next, authorization policies are checked and ephemeral credentials with short TTLs are issued. The administrator then logs into the target through a PAM proxy gateway, which maintains active session monitoring and command logging throughout the connection. Finally, once the access time window lapses, the PAM system automatically revokes credentials and terminates open connections.

Adım Adım Çözüm

1
Identify the request phase
The administrator submits an access request with ticket justification via the PAM portal.
JIT workflows require explicit administrative intent and justification prior to provisioning privileges.
2
Determine the provisioning phase
The PAM controller evaluates the rule baseline and generates an ephemeral, short-lived credential.
Credentials must be dynamically created with strict Time-to-Live (TTL) attributes before access can be granted.
3
Identify the session entry phase
The administrator establishes a database session routed through the PAM proxy gateway using the ephemeral credential.
Routing connections through a proxy ensures direct database access is blocked and session telemetry is captured.
4
Determine the operational monitoring phase
The proxy gateway performs active session recording and real-time command monitoring.
Active monitoring must happen concurrently with session execution to maintain auditability and prevent unauthorized command execution.
5
Identify the teardown phase
The PAM system automatically invalidates the short-lived credential and terminates active proxy sessions upon window expiration.
Automated revocation enforces zero lingering privileges and minimizes standing access risks.

Anahtar Kavram

Just-In-Time (JIT) Privileged Access Management (PAM) Lifecycle
Soru 429Soru →

A digital forensics examiner is performing evidence collection on a powered-on enterprise server following a suspected breach. To ensure maximum preservation of transient evidence, the examiner must adhere strictly to the forensic Order of Volatility. Sequence the following evidence sources from most volatile (highest priority for acquisition) to least volatile (lowest priority for acquisition).

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct acquisition sequence from most volatile to least volatile is: Processor cache and CPU registers, followed by Physical system RAM and running process tables, followed by Swap files and pagefile space on local disk storage, and ending with Offline archival backup tapes.
Standard digital forensics practices (RFC 3227) require collecting evidence in order of volatility to prevent losing perishable data. CPU registers and cache change at instruction-level speeds and are most volatile. Physical RAM loses contents upon reboot or power-off. Swap and pagefiles reside on disk but hold temporary, frequently modified memory blocks. Offline archival tapes are static physical media stored offsite, making them the least volatile.

Adım Adım Çözüm

1
Identify the data source with the shortest lifetime that changes during hardware execution.
Processor cache and CPU registers are placed first.
Registers and CPU caches alter state with every clock cycle and cannot be preserved once execution progresses or power changes.
2
Identify volatile system memory retained only while power is maintained.
Physical system RAM and running process tables are placed second.
System memory holds dynamic network connections, process structures, and unencrypted keys that disappear if the machine powers down.
3
Identify temporary disk-backed virtual memory structures.
Swap files and pagefile space on local disk storage are placed third.
Pagefiles reside on non-volatile physical disks, but their data blocks are temporary and actively overwritten by operating system memory management.
4
Identify long-term static offline storage media.
Offline archival backup tapes are placed last.
Archival media is offline, unpowered, and structurally static, making it the most durable and least volatile evidence source.

Anahtar Kavram

Order of Volatility in Digital Forensics
Soru 430Soru →

A security operations team discovers that critical production servers frequently experience configuration drift due to uncoordinated hotfixes applied by system administrators during emergency outage incidents. Although automated configuration auditing tools successfully flag these non-compliant system states during nightly scans, security engineers cannot readily distinguish between unauthorized vulnerabilities and approved emergency hotfixes. Which of the following solutions should the security team implement to effectively manage configuration drift while maintaining audit compliance for emergency changes?

Cevabı ve açıklamayı göster

Cevap: Integrate automated configuration management systems with the service management database to dynamically reconcile live endpoint baseline scans against authorized emergency change requests.

Cevap

Integrate automated configuration management systems with the service management database to dynamically reconcile live endpoint baseline scans against authorized emergency change requests.
Integrating automated configuration monitoring tools with the service management database (CMDB) bridges the gap between technical drift detection and administrative change management. When an emergency hotfix alters a server baseline, the configuration management tool checks the CMDB for a corresponding approved emergency change ticket. If a valid ticket exists, the baseline variation is recognized as authorized drift; if no ticket exists, it is treated as unauthorized configuration drift requiring remediation.

Adım Adım Çözüm

1
Analyze the operational problem
Identify that the core issue is an inability to correlate live configuration drift with legitimate emergency change documentation.
Security operations need continuous automated verification without breaking emergency change management workflows.
2
Evaluate patch and configuration management governance
Determine that linking configuration assessment tools with formal IT service management (ITSM/CMDB) tracking enables real-time verification of baseline exceptions.
Automated reconciliation ensures unauthorized drift is highlighted for remediation while authorized emergency hotfixes are automatically reconciled against open change tickets.
3
Differentiate governance roles and control functions
Reject responses that misclassify control categories (detective vs. preventive), misapply network mitigations to system states, or break role separation.
Maintaining proper security control classification and role boundaries is critical for enterprise security posture.

Anahtar Kavram

Configuration Drift and Automated Baseline Reconciliation
Soru 431Soru →

A security engineer is refining the vulnerability assessment strategy for an enterprise data center hosting high-availability web applications and legacy backend databases. To ensure deep asset visibility while mitigating the risk of service disruption and unauthorized network impact, which of the following operational practices should the engineer implement? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Schedule intrusive vulnerability scanning templates exclusively during pre-approved maintenance windows.; Use credentialed access to audit local system configurations, installed software inventories, and missing patches.

Cevap

The security engineer should schedule intrusive vulnerability scan templates exclusively during pre-approved maintenance windows and use credentialed access to audit local configurations, installed software, and missing patches.
Scheduling intrusive scans during maintenance windows protects production availability from unexpected system crashes, while credentialed scanning provides precise internal configuration visibility with minimal network impact and reduced false positives.

Adım Adım Çözüm

1
Evaluate the operational impact of scan intensity levels on critical assets.
Recognize that intrusive scanning techniques can exhaust host resources or crash legacy services if executed during peak hours.
Intrusive scans actively probe weaknesses and must be confined to maintenance windows to safeguard service availability.
2
Determine the scanning methodology that maximizes accuracy while reducing network overhead.
Select authenticated (credentialed) scanning over unauthenticated network probing.
Credentialed scanning queries local system registries and patch databases directly, reducing false positives without saturating network bandwidth.
3
Differentiate detective scanning tools from preventive and corrective security controls.
Reject firewalls and scanners as automated patch remediation mechanisms.
Scanners are detective controls and firewalls are preventive traffic filters; application flaws require software updates or code refactoring.

Anahtar Kavram

Vulnerability Scanning Methodologies and Operational Controls
Soru 432Soru →

A security engineer is configuring a SIEM collector to process raw syslog feeds from perimeter devices. Place the stages of SIEM log processing in the correct order from initial ingestion to analyst notification.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of SIEM log processing stages is Log Collection & Ingestion, Parsing & Field Extraction, Data Normalization, Event Correlation, and Alert Generation.
The SIEM log processing pipeline must proceed sequentially from raw data capture to actionable intelligence. First, Log Collection & Ingestion gathers raw logs from network sources. Second, Parsing & Field Extraction breaks unstructured strings into distinct field variables. Third, Data Normalization maps vendor-specific variables into a unified schema. Fourth, Event Correlation analyzes normalized fields against detection rules and threat feeds. Finally, Alert Generation dispatches notifications to analysts when correlated events breach security thresholds.

Adım Adım Çözüm

1
Identify the initial entry point of telemetry into the SIEM pipeline.
Log Collection & Ingestion is placed first because raw logs must be received before any processing can occur.
Raw data must be gathered from source endpoints or network appliances first.
2
Identify how raw unstructured strings are structured.
Parsing & Field Extraction is placed second to break raw text strings into discrete data variables.
Extracting key-value pairs is necessary before data can be categorized or standardized.
3
Identify how disparate vendor fields are unified.
Data Normalization is placed third to map extracted variables to a standard schema.
Standardizing field names allows the SIEM to analyze logs from different manufacturers consistently.
4
Determine how security context is established across normalized telemetry.
Event Correlation is placed fourth to evaluate normalized data against rules and threat intelligence.
Correlation logic requires structured, normalized data to accurately detect multi-source threats.
5
Determine the operational output resulting from correlation matches.
Alert Generation is placed fifth to notify security analysts of actionable security events.
Alert dispatches occur as the end result of matched correlation criteria.

Anahtar Kavram

SIEM Log Processing Pipeline
Soru 433Soru →

An enterprise incident response team is evaluating a newly deployed Security Orchestration, Automation, and Response (SOAR) playbook intended to contain compromised systems. The playbook automatically executes a script that isolates host network interfaces upon receiving high-severity endpoint alerts. Security engineers are concerned that automated execution against critical infrastructure, such as domain controllers or primary database hosts, could cause severe business disruptions in the event of a false positive. Which of the following workflow modifications best mitigates this risk while preserving automated containment capabilities for standard endpoints?

Cevabı ve açıklamayı göster

Cevap: Implement conditional branching that requires human-in-the-loop manual authorization before taking isolation actions against designated high-criticality assets.

Cevap

Implement conditional branching that requires human-in-the-loop manual authorization before taking isolation actions against designated high-criticality assets.
Implementing conditional branching with human-in-the-loop (HITL) approval for critical assets allows security operations to isolate standard endpoints automatically while preventing accidental outages of critical infrastructure during false positives.

Adım Adım Çözüm

1
Analyze the operational risk associated with fully automated SOAR playbooks.
Unconditional automated isolation of critical production infrastructure (such as domain controllers) presents high business continuity risk due to potential false positives.
Automated containment actions must balance response velocity with the potential business impact on essential services.
2
Identify playbook design mechanisms to protect critical assets while maintaining automation.
Introducing conditional logic based on asset tags or criticality levels allows standard hosts to be automatically contained while routing high-impact systems to an analyst.
Human-in-the-loop (HITL) approval steps provide necessary governance where downtime consequences are severe.

Anahtar Kavram

SOAR Playbook Logic and Human-in-the-Loop (HITL) Governance
Tahmini Süre:1m 30s
Soru 434Soru →

An enterprise security policy requires that any unauthorized changes to server system configurations are automatically detected and restored to a pre-approved security state. Which of the following operational controls best meets this requirement?

Cevabı ve açıklamayı göster

Cevap: Automated configuration management baseline enforcement

Cevap

Automated configuration management baseline enforcement
Automated configuration management baseline enforcement continuously compares system settings against an established baseline and automatically remediates configuration drift by restoring approved settings.

Adım Adım Çözüm

1
Identify the core requirement in the scenario.
The scenario requires automatic detection and restoration of unauthorized system configuration changes (configuration drift).
Security baselines define approved operational settings, and automated tools enforce compliance against these baselines continuously.
2
Evaluate the technical capabilities of available operational controls.
Automated configuration management tools actively monitor settings and enforce baselines, reverting unauthorized drift automatically without manual intervention.
Other control options act as detective logging mechanisms or network filters rather than internal system configuration enforcement tools.

Anahtar Kavram

Configuration Drift and Automated Baseline Enforcement
Soru 435Soru →

A security administrator is establishing standard operating procedures for system maintenance across enterprise servers. Which of the following actions should be performed prior to deploying software patches to live production servers? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Test updates in a non-production staging environment to verify system stability and software compatibility; Submit proposed updates for formal review and authorization through the change management process

Cevap

Testing updates in a non-production staging environment and submitting proposed updates through formal change management review.
A sound patch management policy requires testing software updates in a non-production staging environment to confirm system stability and software compatibility prior to live deployment. Additionally, submitting the proposed changes through a formal change management process ensures administrative oversight, scheduled maintenance windows, and verified rollback plans.

Adım Adım Çözüm

1
Analyze the patch management lifecycle requirements prior to production deployment.
Identified the need for technical verification and administrative risk governance.
Pre-deployment validation reduces the risk of operational disruption.
2
Evaluate technical pre-deployment procedures.
Staging environment testing verifies functional compatibility without risking live services.
Staging reflects production conditions while isolating potential patch defects.
3
Evaluate administrative governance controls.
Formal change management authorization provides proper approval, scheduling, and rollback planning.
Change control ensures organizational awareness and structured risk management.

Anahtar Kavram

Patch Management and Change Control Lifecycle
Soru 436Soru →

A security operations team is configuring an automated Security Orchestration, Automation, and Response (SOAR) workflow to handle initial triage and containment for incoming high-severity suspicious email alerts. Which of the following tasks represent safe, effective automated steps to include in the initial playbook execution prior to analyst review? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Query external threat intelligence APIs to verify the reputation scores of URLs and attachment hashes found in the message.; Issue API calls to the email gateway to quarantine the matching message across all internal employee mailboxes.

Cevap

The correct response steps are to query external threat intelligence APIs for domain and hash reputation and to quarantine the email message across internal mailboxes using email gateway API integrations.
Automated SOAR playbooks perform best when executing rapid enrichment (such as querying threat intelligence feeds for malicious domain reputation) and targeted, low-risk containment (such as quarantining an email message across mailboxes via API). These steps neutralize immediate exposure while providing rich contextual data for analyst decision-making.

Adım Adım Çözüm

1
Evaluate automated threat enrichment capabilities
Automated threat intelligence queries enrich indicators without impacting business operations.
Enriching alerts with external domain and file hash reputation provides context required for analyst triage.
2
Evaluate low-risk automated containment actions
Quarantining emails at the mail gateway prevents further user interaction.
Removing suspicious messages from recipient mailboxes stops potential phishing execution while preserving system availability.
3
Identify high-risk distractor logic in automated playbooks
Isolating critical infrastructure or locking out recipients causes immediate business disruption.
Executing destructive actions automatically on unverified or low-fidelity indicators creates self-inflicted denial of service.

Anahtar Kavram

SOAR Playbook Design and Low-Risk Automated Response
Soru 437Soru →

A systems administrator deploys a lightweight host-based agent across a fleet of Linux web servers to perform continuous vulnerability assessment. During an audit, the agent flags several critical local kernel vulnerabilities requiring remediation. However, a subsequent uncredentialed network-based vulnerability scan targeting the public IP addresses of these same web servers fails to detect any of the reported kernel flaws. Which of the following best explains why the network vulnerability scan missed these kernel vulnerabilities?

Cevabı ve açıklamayı göster

Cevap: Uncredentialed network scans analyze only network-accessible listening ports and service headers, lacking host-level privileges to inspect internal operating system kernel package manifests.

Cevap

Uncredentialed network scans analyze only network-accessible listening ports and service headers, lacking host-level privileges to inspect internal operating system kernel package manifests.
Uncredentialed network scanners evaluate target hosts from the perspective of an external network observer. They discover open ports, protocols, and service banners. Because operating system kernel vulnerabilities reside inside the host OS and are rarely advertised over network sockets, an uncredentialed network scan cannot audit local package registers or kernel versions. By contrast, a credentialed host agent possesses local system privileges to directly inspect the installed software inventory and kernel build details.

Adım Adım Çözüm

1
Analyze the scanning mechanisms described in the scenario.
Identified two scanning approaches: a credentialed/host-agent scan (inside view) and an uncredentialed network scan (outside view).
Different scan types operate with distinct privilege levels and visibility parameters.
2
Determine the visibility constraints of an uncredentialed network scan.
Uncredentialed network scans query open network ports, banners, and remote service protocol interactions without authenticating to the underlying operating system.
Kernel patch levels are internal system state properties that are not typically exposed via external service banners unless a specific exposed service explicitly advertises its host kernel.
3
Evaluate why the host agent successfully detected the flaw while the network scan did not.
The host agent has local administrative access to inspect installed software manifests, system binaries, and running kernel builds directly, enabling detailed vulnerability detection.
Host agents provide deep visibility into local patch state regardless of open network ports or perimeter controls.

Anahtar Kavram

Credentialed vs. Uncredentialed Vulnerability Scanning Visiblity
Soru 438Soru →

A Security Operations Center (SOC) analyst is reviewing alerts generated by a SIEM correlation rule designed to flag potential credential harvesting activity. Within a five-minute window, a standard domain user workstation generated multiple instances of the following Windows Security Event log entry:

Event ID: 4769
Task Category: Kerberos Service Ticket Operations
TargetUserName: [email protected]
Service Name: MSSQLSvc/db01.contoso.com:1433
Ticket Options: 0x40810000
Ticket Encryption Type: 0x17
Failure Code: 0x0
Client Address: ::ffff:192.168.10.115

Based on this log telemetry, which of the following security events is occurring?

Cevabı ve açıklamayı göster

Cevap: A Kerberoasting attack requesting a service ticket with weak RC4 encryption to crack the service account password offline.

Cevap

A Kerberoasting attack requesting a service ticket with weak RC4 encryption to crack the service account password offline.
The correct answer identifies a Kerberoasting attack. Windows Event ID 4769 logs when a Kerberos service ticket (TGS) is requested. A key indicator of Kerberoasting is a standard user requesting TGS tickets for accounts with registered Service Principal Names (SPNs) specifying weak encryption types such as RC4 (0x17). The attacker can extract the encrypted ticket payload from memory or network traffic and attempt to crack the service account's password offline.

Adım Adım Çözüm

1
Analyze the Event ID and Service Name in the log snippet.
Event ID 4769 records Kerberos service ticket requests (TGS-REQ/TGS-REP) processed by Active Directory Domain Controllers.
Identifying the event type establishes that the activity relates to Kerberos ticket granting rather than application-layer network traffic.
2
Examine the Ticket Encryption Type field value (0x17).
Value 0x17 corresponds to legacy RC4-HMAC encryption.
Attackers specifically request service tickets with weak RC4 encryption because RC4 hashes are significantly easier to crack offline using password dictionary attacks compared to AES encryption (0x12).
3
Synthesize the event telemetry context.
Repeated requests from a standard user workstation for Service Principal Name (SPN) tickets using RC4 encryption indicates Kerberoasting.
Kerberoasting allows non-admin domain users to request TGS tickets for any account with a configured SPN and extract the password hash for offline brute-forcing.

Anahtar Kavram

Kerberoasting Detection via SIEM Log Analysis
Tahmini Süre:1m 30s
Soru 439Soru →

A Security Operations Center (SOC) analyst receives an automated alert from a network intrusion detection system (NIDS) flagging potential command-and-control (C2) beaconing activity from an internal workstation. Place the following incident triage and response steps in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence begins with validating the NIDS alert using raw packet captures and flow logs, followed by isolating the compromised workstation, deploying custom firewall block rules for the C2 IP, and concluding with incident documentation and updating network monitoring baselines.
The standard network security monitoring triage flow requires validating the security alert with raw telemetry first to confirm true positive status. Once validated, containment actions such as host isolation are performed immediately to block active command-and-control communication. Following containment, preventive controls like firewall block rules are updated across the network perimeter. Finally, the analyst completes post-incident procedures by documenting findings and updating monitoring baselines.

Adım Adım Çözüm

1
Validate the NIDS alert using raw network telemetry
Confirmed true positive C2 beaconing activity
Triage validation prevents taking intrusive containment measures on false alarms.
2
Isolate the host machine from the network
C2 communication severed and host network access contained
Immediate containment limits damage and prevents adversary lateral movement.
3
Apply firewall block rules based on extracted indicators
Perimeter network defenses updated with threat indicators
Prevents other internal hosts from communicating with the same external threat infrastructure.
4
Perform post-incident documentation and update detection rules
Network security monitoring baselines and detection logic refined
Ensures lessons learned are incorporated to prevent similar incidents and improve future response speed.

Anahtar Kavram

Incident triage and containment workflow for network security alerts
Soru 440Soru →

During security monitoring of an enterprise cloud environment, an automated alert flags an unauthorized microservice container actively establishing encrypted outbound connections to an external command-and-control (C2) server. Security analysts verify that the container is compromised and holds active database connection tokens. According to standard incident response frameworks, which of the following actions should the security team perform FIRST?

Cevabı ve açıklamayı göster

Cevap: Apply network isolation rules to contain the compromised container and prevent lateral movement or data exfiltration.

Cevap

Apply network isolation rules to contain the compromised container and prevent lateral movement or data exfiltration.
The correct action is to apply network isolation rules to contain the compromised container. Under standard incident response frameworks (NIST SP 800-61 / ISO 27035), once an incident is verified during detection and analysis, the immediate next step is containment to restrict attacker access, halt active exfiltration, and prevent lateral movement within the network.

Adım Adım Çözüm

1
Identify the current phase of the Incident Response lifecycle.
The incident has been detected and verified, moving the response process into the Containment, Eradication, and Recovery phase.
Once an active breach is confirmed, immediate focus must shift to limiting the scope and impact of the incident.
2
Determine the mandatory initial action within the Containment phase.
Apply containment measures (such as network microsegmentation or isolation security group rules) to cut off C2 communication and stop lateral movement.
Containment prevents further data loss or damage while keeping the compromised artifact available for volatile memory capture or analysis.
3
Evaluate remaining actions against the IR lifecycle order.
Actions such as terminating workloads (eradication), redeploying clean builds (recovery), or running post-mortems (lessons learned) occur sequentially after containment.
Executing out-of-order steps exposes the organization to continued risk or destroys critical forensic evidence.

Anahtar Kavram

Incident Response Lifecycle Phase Order (Containment First)
ÖncekiSayfa 22 / 32Sonraki
Security Operations Alıştırma Soruları — CompTIA Security+ — Sayfa 22 | Examkin