Examkin

Security Operations

627 soru

Tüm türler627Çoktan seçmeli320Çoklu seçim139Eşleştirme36Sıralama132
Soru 441Soru →

An enterprise system administrator identifies suspicious administrative tool execution on a human resources endpoint. EDR telemetry reports that an unauthorized process is actively attempting lateral movement across internal subnets using compromised domain credentials. Which of the following actions should the security engineer take FIRST using the EDR platform to stop the attack while maintaining investigation capabilities?

Cevabı ve açıklamayı göster

Cevap: Initiate host isolation on the affected endpoint through the EDR agent console

Cevap

Initiate host isolation on the affected endpoint through the EDR agent console.
Executing network host isolation directly through the EDR console immediately disconnects the compromised endpoint from all internal network resources, neutralizing lateral movement while maintaining EDR agent connectivity for SOC analysis and forensic triage.

Adım Adım Çözüm

1
Analyze the EDR behavioral alert
Identified active lateral movement attempts originating from the endpoint
Immediate containment is required to prevent compromise of adjacent systems on the internal network.
2
Select the appropriate EDR response action
Apply network host isolation via the EDR platform agent
Host isolation disables internal endpoint networking while maintaining the management control channel for security analysis.

Anahtar Kavram

Endpoint Containment and Host Isolation
Soru 442Soru →

A security analyst is conducting live evidence acquisition on a compromised application server following a suspected data exfiltration attempt. The analyst needs to preserve network statistics, system RAM, swap space, and non-volatile storage while minimizing data alteration. According to the standard order of volatility, which of the following evidence types should the analyst acquire FIRST?

Cevabı ve açıklamayı göster

Cevap: Routing table and active network connections

Cevap

Routing table and active network connections must be acquired first because they are the most volatile form of evidence listed.
In digital forensics, the order of volatility governs evidence collection sequence to prevent data loss. According to RFC 3227, highly dynamic system states—such as CPU registers, routing tables, ARP caches, kernel statistics, and active network connections—must be captured before secondary storage like swap space or local hard drives.

Adım Adım Çözüm

1
Identify the volatility level of each evidence source listed in the scenario.
Network state (routing tables, open connections) is extremely fleeting, followed by physical RAM, swap space/temp files, non-volatile disk images, and remote archival logs.
The Order of Volatility principles dictate acquiring evidence starting from the most ephemeral (fastest changing) to the most persistent.
2
Compare the candidate options against the established order of volatility (RFC 3227).
Active network connections and routing tables rank higher in volatility than swap files, physical disk partitions, or remote log repositories.
Network states can disappear instantly if a network interface drops or a socket connection closes.

Anahtar Kavram

Order of Volatility in Digital Forensics
Soru 443Soru →

A security engineer analyzing packet telemetry from an inline Network Intrusion Prevention System (NIPS) notices a high-priority alert triggered by inbound traffic directed at a public-facing web server. The alert details contain the following HTTP payload snippet:

`GET /catalog.php?item_id=105%27%20UNION%20SELECT%20null,username,password_hash%20FROM%20user_credentials--%20HTTP/1.1`
`Host: portal.example.com`

The engineer must select a targeted mitigation control that specifically blocks this attack payload while preserving uninterrupted HTTP/HTTPS access for legitimate users. Which of the following actions should the engineer take?

Cevabı ve açıklamayı göster

Cevap: Deploy a Web Application Firewall (WAF) rule to inspect layer 7 payload parameters and block requests containing SQL syntax tokens.

Cevap

Deploying a Web Application Firewall (WAF) rule to inspect layer 7 parameters and block requests containing SQL syntax tokens effectively mitigates the SQL injection payload while keeping standard web services available.
The log snippet reveals a URL-encoded SQL injection string (`UNION SELECT ... FROM user_credentials`). Because SQL injection is an application-layer (Layer 7) vulnerability, a Web Application Firewall (WAF) is the appropriate control. A WAF inspects HTTP/HTTPS payload contents and parameter values to block malicious database query structures while allowing benign web traffic through.

Adım Adım Çözüm

1
Analyze the NIPS log payload
Identified the URL-encoded payload `%27%20UNION%20SELECT%20null,username,password_hash%20FROM%20user_credentials--` as a classic SQL Injection (SQLi) attempt aimed at extracting database records.
Accurate alert classification is necessary to choose an effective mitigation strategy.
2
Evaluate control layer requirements
SQL injection attacks occur at Layer 7 (Application layer) inside standard HTTP request parameters.
Traditional network firewalls Operating at Layer 3/4 cannot inspect application payloads and would block all legitimate traffic if port-level blocks were applied.
3
Select the precise security control
A Web Application Firewall (WAF) operates at Layer 7 to inspect parameter values against signature patterns (such as `UNION SELECT`) and block malicious attempts without disrupting valid traffic.
WAF rules provide target-specific inline protection against web application attacks.

Anahtar Kavram

Layer 7 Network Security Monitoring and WAF Mitigation
Soru 444Soru →

A Security Operations Center (SOC) team is deploying an automated Security Orchestration, Automation, and Response (SOAR) playbook to address high-risk suspicious email reports. To prevent accidental disruption to critical business communications while ensuring rapid response, the automated response workflow must follow strict SOC governance standards spanning ingest, threat intelligence enrichment, analyst review, containment, and post-incident cleanup. In what sequence should the SOAR playbook execute these operational steps?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational order begins with alert payload ingestion and IOC parsing, followed by automated threat intelligence enrichment, triggering a Human-in-the-Loop (HITL) approval gate, executing automated host isolation and token revocation upon authorization, and concluding with perimeter blocklist updates and case closure.
In SOAR playbook architecture, incident response follows a structured sequence: initial data ingestion and IOC extraction, automated threat intelligence lookup, decision governance via Human-in-the-Loop (HITL) verification for high-impact remediations, automated execution of containment scripts, and final documentation with blocklist propagation.

Adım Adım Çözüm

1
Parse input payload
Extracted URLs, domain names, and email headers ready for automated processing.
Automation workflows require structured data inputs before external API integrations can be invoked.
2
Enrich indicators using threat intelligence tools
Aggregated threat scores and reputation analysis metrics.
Enrichment provides the necessary contextual data to evaluate severity before decision-making.
3
Execute Human-in-the-Loop (HITL) authorization step
Analyst confirmation or rejection of the proposed mitigation actions.
High-impact containment actions require human oversight to prevent operational downtime on critical enterprise accounts.
4
Enforce endpoint containment and credential revocation
Host network isolation and invalidated active authentication tokens.
Approved remediation tasks stop active session abuse and lateral movement across the network.
5
Finalize incident documentation and feed defensive perimeter controls
Updated SIEM entries, synchronized firewall blocklists, and resolved SOAR tickets.
Final documentation ensures audit compliance and prevents repeat attacks across the enterprise edge.

Anahtar Kavram

SOAR Playbook Execution Lifecycle and Governance
Soru 445Soru →

A Security Operations Center (SOC) analyst receives an automated high-severity SIEM alert indicating suspicious outbound traffic from an internal database server containing sensitive customer records to an unknown external IP address over port 443. The analyst must follow network security monitoring and initial incident response procedures. In what chronological sequence should the analyst execute the following triage and containment actions?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of actions begins with analyzing NetFlow records and SIEM log correlations, followed by inspecting NIDS alerts and full packet captures (PCAP), then applying network isolation controls to the database host, and finally updating perimeter firewall rules to block the external destination IP address.
The triage process follows a logical sequence from high-level flow verification to payload inspection, host isolation, and perimeter defense. Flow telemetry (NetFlow/SIEM) is evaluated first to confirm the alert boundaries. NIDS alerts and PCAP files are then examined to identify IoCs and malicious payloads. Next, host containment stops active data exfiltration while preserving volatile evidence. Finally, blocking the external malicious IP at the perimeter safeguards the broader enterprise architecture.

Adım Adım Çözüm

1
Analyze NetFlow records and SIEM log correlations
Establishes baseline traffic metrics and verifies anomalous session characteristics.
Initial triage requires confirming session duration, flow volume, and endpoints before launching detailed analysis.
2
Inspect NIDS alerts and full packet captures (PCAP)
Extracts protocol payload details, certificate info, and threat signatures.
Detailed packet inspection provides context on the attack payload and identifies actionable indicators of compromise.
3
Apply network isolation controls to the affected database host
Halts ongoing exfiltration from the compromised system while preserving forensic artifacts in memory.
Host containment must occur immediately once a compromise is confirmed to prevent further unauthorized data access.
4
Update perimeter firewall rules to block the external destination IP address
Prevents potential lateral exfiltration attempts from other enterprise hosts to the malicious destination.
System-wide perimeter blocking ensures enterprise defense after containing the immediate host threat.

Anahtar Kavram

Incident Response and Triage Workflow in Network Security Monitoring
Soru 446Soru →

A security operations team is deploying a enterprise cloud application integrated with an internal Identity Provider (IdP) using SAML 2.0. Arrange the operational steps of a Service Provider-initiated (SP-initiated) Single Sign-On (SSO) authentication sequence in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence for SP-initiated SAML 2.0 SSO is: 1) Initial resource request to the SP, 2) Redirection with SAML AuthnRequest to the IdP, 3) User authentication at the IdP, 4) Redirection with signed SAML Assertion back to SP's ACS, and 5) Signature validation and session creation by the SP.
In SAML 2.0 SP-initiated Single Sign-On, the sequence begins with an unauthenticated request to the Service Provider. The SP redirects the user's browser with a SAML AuthnRequest to the Identity Provider. Next, the user authenticates directly at the IdP. Upon successful authentication, the IdP redirects the user back to the SP's Assertion Consumer Service (ACS) endpoint with a signed SAML Assertion containing identity attributes. Finally, the SP verifies the assertion signature and establishes the user session.

Adım Adım Çözüm

1
Identify the entry point of the SP-initiated authentication workflow.
The user initiates contact by requesting access directly at the Service Provider application.
In SP-initiated SSO, the flow starts at the resource provider, unlike IdP-initiated SSO where the user visits the IdP portal first.
2
Determine how the Service Provider directs the user to the authentication authority.
The SP issues an HTTP redirect containing a SAML AuthnRequest targeted at the IdP SSO URL.
The SP cannot authenticate the user locally, so it delegates identity verification by redirecting the client browser.
3
Trace the primary authentication event at the Identity Provider.
The user supplies primary credentials and completes mandatory MFA challenges at the IdP portal.
Authentication occurs strictly between the user browser and the IdP, ensuring credentials are never exposed to the SP.
4
Trace the return path of identity claims to the Service Provider.
The IdP redirects the browser to the SP's Assertion Consumer Service (ACS) with a signed SAML Response assertion.
The SAML assertion serves as cryptographically verifiable proof that the user successfully authenticated at the IdP.
5
Finalize session establishment and access authorization.
The SP validates the digital signature using the IdP's public key certificate and logs the user into the local application context.
Verifying the signature ensures the assertion came from a trusted IdP and was not altered during transit by a man-in-the-middle.

Anahtar Kavram

SAML 2.0 SP-Initiated Authentication Flow
Soru 447Soru →

A Security Operations Center (SOC) analyst receives a high-severity alert from an enterprise Endpoint Detection and Response (EDR) platform. Telemetry indicates an unprivileged user account initiated a obfuscated command execution that attempted process injection into `lsass.exe` and established an encrypted outbound connection to an untrusted external IP address. Which TWO of the following actions represent capabilities native to an EDR solution that the analyst should execute to contain the threat and facilitate analysis?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Apply host network isolation through the EDR agent software to sever attacker communication while maintaining management console connectivity.; Issue a remote live response command via the EDR console to dump volatile RAM contents and terminate the malicious parent process tree.

Cevap

The analyst should isolate the host via the EDR agent console and execute a remote live response action to dump volatile memory and kill the malicious process tree.
Host network isolation directly through the EDR console stops malicious communication while preserving management control, and remote live response tools enable analysts to capture volatile memory and terminate running processes on the target host.

Adım Adım Çözüm

1
Identify EDR containment capabilities.
Host isolation via the EDR agent restricts host network traffic to only the EDR management channel, neutralizing network activity without disabling endpoint telemetry.
Prevents lateral movement and remote C2 without taking the host offline completely from the security team.
2
Identify EDR live response and forensic capabilities.
EDR consoles permit remote execution of administrative scripts to dump memory for forensic capture and kill process trees executing injected code.
Allows immediate threat eradication and forensic collection directly on the endpoint.

Anahtar Kavram

EDR Host Containment and Live Response Features
Tahmini Süre:1m 30s
Soru 448Soru →

A security technician is deploying monitoring sensors across an enterprise network. Which of the following statements correctly describe the features and operational behavior of a passive Network Intrusion Detection System (NIDS)? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: It analyzes mirrored network traffic from a switch port without introducing latency to live network packets.; It generates security alerts upon detecting signature matches but does not actively stop or alter packets in transit.

Cevap

The correct options state that a passive Network Intrusion Detection System (NIDS) analyzes mirrored network traffic without introducing latency to live packets and generates security alerts without actively stopping or altering traffic in transit.
A passive Network Intrusion Detection System (NIDS) operates out-of-band by analyzing duplicated network traffic (such as traffic provided by SPAN ports or network TAPs). Because it processes copies of packets out-of-band, it does not add latency to production traffic flows and acts as a detective control by generating alerts when malicious signatures are matched, without interrupting packet transit.

Adım Adım Çözüm

1
Identify the operational placement of a passive Network Intrusion Detection System (NIDS).
A passive NIDS is deployed out-of-band, receiving duplicated traffic from TAP or SPAN/mirror ports.
Out-of-band deployment ensures that monitoring activities do not add latency to active network communications.
2
Determine the control function and capabilities of a passive monitoring solution.
Passive NIDS devices act as detective controls by analyzing traffic against known signature sets and alerting administrators.
Since the NIDS receives copied packets out-of-band, it lacks inline capability to modify or drop malicious network traffic directly.

Anahtar Kavram

Passive Out-of-Band Network Intrusion Detection
Soru 449Soru →

A security technician is documenting the standard patch deployment workflow for enterprise operating systems. Place the following stages of the patch management lifecycle in the correct order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for the patch management lifecycle is: 1. Identify and assess newly released vendor patches -> 2. Test the patch in a staging environment -> 3. Submit the patch deployment plan to the Change Advisory Board (CAB) -> 4. Deploy the patch to production systems -> 5. Perform post-installation auditing.
The standard patch management process follows a structured lifecycle: identification of updates, non-production testing, change management authorization, controlled production deployment, and post-deployment validation auditing.

Adım Adım Çözüm

1
Identify available patches
Discovers vendor updates requiring evaluation.
Security operations must monitor vendor advisories and assess patch severity before taking operational action.
2
Perform staging and testing
Confirms patch compatibility without affecting live systems.
Testing ensures updates do not cause system crashes or application conflicts.
3
Request change authorization
Obtains formal CAB review and approval.
Change management governance mandates documentation and risk review prior to production modification.
4
Execute production deployment
Installs patches on production assets.
Deployment must occur during scheduled maintenance windows to minimize business impact.
5
Conduct post-patch verification and auditing
Confirms compliance and closure of vulnerability.
Auditing verifies that installation succeeded and configuration baselines remain secure.

Anahtar Kavram

Standard Patch Management Lifecycle Workflow
Soru 450Soru →

A security analyst reviews a network security monitoring alert generated by a Network Intrusion Detection System (NIDS). The alert log highlights the following HTTP GET parameter string:

`GET /login.php?username=admin'%20OR%20'1'='1'-- HTTP/1.1`

Which of the following best identifies the type of malicious activity captured in this alert?

Cevabı ve açıklamayı göster

Cevap: SQL injection attempt designed to bypass database authentication logic

Cevap

SQL injection attempt designed to bypass database authentication logic
The URL-decoded string `admin' OR '1'='1'--` is a classic SQL injection payload. Attackers inject single quotes, boolean tautologies (like `'1'='1'`), and SQL comment flags (`--`) to force the backend database query to return true, bypassing authentication controls.

Adım Adım Çözüm

1
Analyze the HTTP GET request parameter string in the NIDS alert log.
Identified the payload string: username=admin'%20OR%20'1'='1'--
URL-decoded payload represents admin' OR '1'='1'--, which manipulates SQL query logic.
2
Evaluate the attack vector and security monitoring classification.
Matches SQL injection (SQLi) syntax targeting the application backend database.
SQLi uses single quotes, boolean OR statements, and comment characters to alter backend database behavior.

Anahtar Kavram

Identifying SQL Injection Indicators in Network Security Alerts
Soru 451Soru →

During an on-site physical security review of a remote branch office, a security analyst discovers an unauthorized rogue wireless access point plugged into an active wall jack. The rogue device is actively broadcasting a duplicate corporate SSID to intercept wireless client credentials. Following standard incident response playbooks, which of the following immediate containment actions should the incident response team perform? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Disable the specific network switch port where the rogue access point is physically attached.; Apply a quarantine access control list (ACL) to isolate traffic from the affected network segment.; Re-image the enterprise core switch operating system to remove potential malicious persistence.; Clear the switch MAC address table and volatile system logs to reset network state.

Cevap

The correct containment actions are disabling the connected switch port and applying a quarantine ACL to isolate traffic from the affected segment.
Disabling the physical switch port immediately blocks the rogue access point from transmitting data across the wired enterprise network. Concurrently, applying a quarantine access control list (ACL) isolates traffic on the affected segment, preventing unauthorized lateral movement. Both steps fulfill containment objectives by isolating the threat without destroying evidence.

Adım Adım Çözüm

1
Identify the primary operational objective of the containment phase in incident response.
The containment phase focuses on limiting the scope and impact of an incident without destroying forensic evidence.
Containment prevents threat expansion while allowing responders time to collect volatile evidence and plan eradication.
2
Evaluate actions that immediately restrict rogue access point network traffic.
Disabling the switch port cuts off network connectivity at the access layer, and applying a quarantine ACL prevents lateral movement on the segment.
Both measures effectively isolate the threat without altering evidence on the rogue hardware or erasing infrastructure logs.
3
Differentiate containment phase actions from premature eradication or destructive evidentiary steps.
Re-imaging switch firmware belongs in the eradication phase, while clearing volatile system logs violates evidence preservation principles.
Proper lifecycle execution ensures evidence integrity and prevents operational disruption prior to full investigation.

Anahtar Kavram

Incident Response Containment Phase for Physical Security Incidents
Tahmini Süre:1m 30s
Soru 452Soru →

Security telemetry on a corporate workstation detects a suspicious living-off-the-land binary attempting to dump process memory and establish outbound command-and-control communication. Which feature of an Endpoint Detection and Response (EDR) agent should be executed FIRST to prevent potential lateral movement while preserving remote investigation capabilities?

Cevabı ve açıklamayı göster

Cevap: Apply host network isolation via the EDR agent console

Cevap

Apply host network isolation via the EDR agent console
Host network isolation restricts all network traffic on the endpoint except for encrypted communication between the EDR agent and the management console. This effectively stops lateral movement and outbound command-and-control channels without interrupting live response triage capabilities.

Adım Adım Çözüm

1
Analyze the security alert requirements.
The goal is to stop lateral movement and command-and-control traffic immediately while maintaining remote administrative access for triage.
Threat containment must prioritize stopping attack propagation without losing live analysis capabilities.
2
Evaluate EDR endpoint isolation capabilities.
EDR host isolation drops non-essential inbound and outbound traffic at the endpoint agent level while keeping the EDR control plane active.
This provides containment while preserving volatile memory and analyst access.

Anahtar Kavram

EDR Host Isolation and Incident Containment
Soru 453Soru →

A security engineer at a financial institution is establishing a patch and configuration management framework for dual-homed payment processing nodes. The environment requires continuous compliance enforcement against baseline images, strict change validation before production deployment, and protection against unauthorized system modifications. Which of the following strategies should the security engineer implement to maintain secure configuration baselines and control patch deployment risks? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Utilize automated infrastructure-as-code configuration management tools to continuously audit system state and automatically remediate configuration drift back to approved baselines.; Staging patch updates in an isolated test environment and verifying cryptographic signature hashes prior to deploying updates into production.

Cevap

The security engineer should utilize automated infrastructure-as-code tools to continuously audit and remediate configuration drift, and stage patch updates in an isolated environment while verifying cryptographic signature hashes before production deployment.
Automated infrastructure-as-code tools continuously validate system settings against established security baselines and automatically remediate configuration drift. Additionally, staging patches in an isolated environment combined with verifying cryptographic signatures prevents unstable or malicious update packages from compromising production systems.

Adım Adım Çözüm

1
Analyze configuration maintenance requirements
Identified the need for continuous drift detection and enforcement using automated configuration baselines.
Manual baseline auditing is ineffective in dynamic environments, making automated remediation via configuration management essential for eliminating drift.
2
Evaluate patch deployment risk mitigation controls
Selected pre-deployment staging and cryptographic hash verification.
Testing patches in staging prevents unexpected service outages, and verifying signature hashes guarantees patch integrity against tampering.
3
Assess distractor validity
Rejected using firewalls as permanent patch replacements and misclassifying control categories.
Firewalls do not remediate system code flaws, and mislabeling control types invalidates risk governance modeling.

Anahtar Kavram

Continuous baseline configuration enforcement and staged patch verification
Soru 454Soru →

A security engineer at an e-commerce organization is investigating an alert indicating anomalous privileged activity on a production database cluster. The authentication and operational log snippet shows:

ParameterLog Entry Details
Timestamp2026-07-27T14:22:10Z
Accountadmin_jsmith
Source IP198.51.100.45 (External WAN)
AuthenticationRADIUS with MFA (Success)
Executed ActionGRANT ALL PRIVILEGES ON customer_db TO temp_user;
Matched PolicyDefault_Admin_Role

The organization's security policy mandates that all privileged administrative sessions on critical systems must be brokered exclusively through a Privileged Access Management (PAM) jump host with short-lived session checkout. Which of the following is the MOST effective operational control modification to prevent direct administrative command execution outside the PAM solution?

Cevabı ve açıklamayı göster

Cevap: Reconfigure network access control lists and authorization policies to restrict administrative session initiation strictly to designated PAM jump host IP addresses.

Cevap

Reconfigure network access control lists and authorization policies to restrict administrative session initiation strictly to designated PAM jump host IP addresses.
Enforcing network access control lists (ACLs) and restricting authorization rules so that administrative access is accepted only from designated PAM jump host IP addresses provides a preventive control. This ensures all privileged sessions are brokered, recorded, and managed according to enterprise IAM operational policy.

Adım Adım Çözüm

1
Analyze the log entries and identify the security policy violation.
The log shows a direct RADIUS-authenticated session executing privileged database commands from an external WAN IP address, bypassing the required PAM jump host.
Privileged access management policies require all administrative sessions to be brokered, audited, and isolated through a dedicated PAM proxy or jump server.
2
Evaluate the required security control type to eliminate direct access bypass.
Enforcing network-level Access Control Lists (ACLs) and authorization policies at the database listener layer ensures that only connections originating from the PAM jump host IP address are accepted for administrative accounts.
Preventive network and authorization controls stop unauthorized direct connections before session establishment occurs.

Anahtar Kavram

Privileged Access Management (PAM) Session Brokering & Enforcement
Soru 455Soru →

A cybersecurity analyst is preparing to transport a seized, powered-off desktop computer from a remote branch office to the central digital forensics laboratory. Which of the following procedures must be performed to maintain the chain of custody and preserve physical evidence integrity during transit? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Record the equipment serial numbers, transfer timestamps, and signatures of both the transferring and receiving custodians on a formal tracking form.; Place the hard drive in a tamper-evident anti-static bag and seal it prior to secure physical transport.

Cevap

Maintaining chain of custody and physical evidence integrity during transportation requires documenting all transfer details with custodian signatures on a formal tracking log and securing evidence inside sealed, tamper-evident anti-static packaging.
Chain of custody requires continuous tracking of evidence possession via detailed logs containing timestamps, serial numbers, and signatures. Physical evidence must also be packaged in sealed, tamper-evident, anti-static containers to guard against physical damage and tampering.

Adım Adım Çözüm

1
Identify chain of custody tracking requirements
Every physical transfer of digital evidence must record the date, time, unique identifiers (such as serial numbers), purpose of transfer, and signatures of both releasing and receiving custodians.
This establishes accountability and legally proves who had possession of the evidence at all times.
2
Identify physical evidence preservation standards
Physical components such as hard drives must be stored in tamper-evident anti-static bags to prevent electrostatic discharge damage and provide clear indicators of unauthorized access.
Ensuring physical protection prevents evidence contamination or damage during transit.
3
Evaluate prohibited modifications to original media
Actions that modify the drive contents (such as applying encryption) or boot the operating system directly (altering system logs/timestamps) corrupt original evidence.
Forensic evidence acquisition requires static bit-stream imaging using write-blocking technology in controlled lab settings, not live unblocked execution at a remote site.

Anahtar Kavram

Preserving chain of custody documentation and physical evidence integrity during transport
Soru 456Soru →

A system administrator updates a cluster of web servers with an emergency software patch. Immediately after the update, users report that web applications hosted on those servers are failing to load. Which of the following actions should the administrator take FIRST to restore system functionality?

Cevabı ve açıklamayı göster

Cevap: Execute the documented rollback plan to revert the servers to their known good baseline configuration.

Cevap

Execute the documented rollback plan to revert the servers to their known good baseline configuration.
When a patch causes unexpected service outage or instability in production, the immediate action within configuration management is to execute a tested rollback plan to restore services to the last known good baseline.

Adım Adım Çözüm

1
Identify the immediate operational impact following the patch deployment.
The newly applied patch caused application instability and service disruption.
When a patch causes system failure, immediate operational recovery is required.
2
Initiate the emergency rollback procedures associated with the patch deployment plan.
The servers revert to the previously verified baseline state.
Rollback plans ensure rapid recovery to a stable configuration minimalizing downtime.

Anahtar Kavram

Rollback Planning and Configuration Baselines
Soru 457Soru →

A security analyst is triaging log files collected by a SIEM system across web applications, authentication servers, and system logs. Match each log snippet on the left to the corresponding security event or attack vector on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

192.168.1.50 - - [27/Jul/2026:10:14:32] "GET /products.php?id=1%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1" 200 452
Jul 27 10:15:01 server1 sshd[4102]: Failed password for invalid user admin from 203.0.113.45 port 51234 ssh2 (repeated 450 times in 60s)
Event ID 4624: An account was successfully logged on. Logon Type: 10 (RemoteInteractive). Account Name: AdminUser.
10.0.0.15 - - [27/Jul/2026:10:20:00] "GET /../../../../etc/passwd HTTP/1.1" 403 220

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The HTTP snippet containing 'UNION SELECT' matches SQL Injection; the repeated SSH failed authentication log matches SSH Brute-Force; Windows Event ID 4624 with Logon Type 10 matches RDP Interactive Session; and the HTTP request with '../../' sequences matches Directory/Path Traversal.
Each log entry displays distinct forensic indicators: 'UNION SELECT' points directly to SQL injection; repeated SSH authentication failures indicate brute-force attempts; Windows Event 4624 with Logon Type 10 marks remote interactive RDP logons; and dot-dot-slash patterns indicate path traversal attempts.

Adım Adım Çözüm

1
Analyze Web Application Logs
Identified SQL query keywords ('UNION SELECT') in the query string of the first log entry and directory navigation dot-dots ('../../') in the fourth entry.
Web logs reveal application-level attacks targeting backend databases or sensitive file paths.
2
Analyze Linux Authentication Logs
Identified high-frequency failed password entries for SSH targeting administrative users from an external IP.
Syslog authentication events with high frequency from single sources characterize automated password guessing.
3
Analyze Windows Event Logs
Correlated Event ID 4624 (Successful Logon) with Logon Type 10.
Logon Type 10 is reserved for RemoteInteractive connections such as RDP, distinguishing it from local (Type 2) or network share (Type 3) logons.

Anahtar Kavram

Log Telemetry Analysis and Threat Identification
Soru 458Soru →

A Security Operations Center (SOC) is designing an automated Security Orchestration, Automation, and Response (SOAR) workflow to handle high-severity alerts triggered when an Amazon S3 storage bucket hosting confidential customer data is modified to allow public read access. The playbook must rapidly mitigate public data exposure while ensuring operational continuity for legitimate internal microservices that depend on the bucket. Which TWO of the following design choices should be incorporated into the automated response playbook to achieve effective containment without causing catastrophic service disruption?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an automated playbook action to invoke cloud API webhooks that immediately apply an explicit 'Block Public Access' policy to the bucket while leaving authenticated IAM roles intact.; Include an automated enrichment step that queries cloud audit logs for recent policy change events and appends access metadata to the incident ticket prior to triggering analyst notifications.

Cevap

The correct playbook design choices are to invoke cloud API webhooks that apply an explicit public access block to the S3 bucket while preserving authenticated IAM access, and to include automated enrichment that queries cloud audit logs for policy change events to context-enrich the incident ticket.
The correct options properly balance rapid automated containment with operational safety and forensic enrichment. Utilizing API webhooks to apply a public access block neutralizes the misconfiguration immediately without invalidating internal IAM roles required by microservices. Simultaneously, automating the retrieval of audit log metadata provides essential context to responders without delaying containment.

Adım Adım Çözüm

1
Evaluate containment mechanisms for object storage exposure.
Identified that applying an explicit public block via API webhooks surgically eliminates internet exposure without disrupting internal IAM-authenticated services.
Containment actions in SOAR playbooks must isolate the threat vector without breaking production dependencies.
2
Assess the role of context enrichment in automated incident workflows.
Determined that gathering recent API audit log trails automatically enriches the ticket with attacker/user context for effective analyst triage.
SOAR platforms excel at aggregating threat intelligence and log metadata before escalating to human responders.
3
Analyze distractor containment and control options for operational risk and technical feasibility.
Rejected bucket deletion due to severe operational damage and rejected host IPS agent installation due to the architectural reality of cloud object storage services.
Automated playbooks must avoid destructive actions on production data assets and must respect cloud platform control boundaries.

Anahtar Kavram

SOAR Playbook Containment Logic and Context Enrichment
Soru 459Soru →

During an ongoing internal incident investigation, a security analyst suspects that a logged-in workstation is currently running an active malicious process in memory that is exfiltrating sensitive database records to an external server. The system is powered on and connected to the local network. To ensure maximum evidentiary value and legal admissibility for potential prosecution, which of the following actions should the analyst take FIRST?

Cevabı ve açıklamayı göster

Cevap: Capture the system's volatile memory (RAM) using an approved live acquisition tool before powering off or disconnecting the device.

Cevap

Capturing the system's volatile memory (RAM) using an approved live acquisition tool before taking any action that modifies the system state.
According to standard digital forensics guidelines and RFC 3227 (Order of Volatility), evidence must be gathered starting from the most volatile items to the least volatile items. Active system memory (RAM) containing execution stacks, network connections, and unencrypted keys is highly perishable and must be preserved prior to powering down or performing disk-level imaging.

Adım Adım Çözüm

1
Evaluate the current operational state of the compromised host system.
The target computer is powered on with active processes running in system memory.
Understanding host state determines which artifacts are most volatile and at risk of immediate loss.
2
Apply the Order of Volatility principles to sequence evidence acquisition.
System memory (RAM) and active cache/registers take priority over non-volatile hard disk storage and remote logs.
Volatile data disappears when the device loses power or shuts down, whereas disk data persists across reboots.
3
Execute live memory capture using an authorized forensic acquisition tool.
A cryptographically hashed RAM dump file is preserved for forensic analysis.
This captures the running malicious process, injected code, and active network connections without destroying evidence.

Anahtar Kavram

Order of Volatility in Digital Forensics
Soru 460Soru →

A Security Operations Center (SOC) analyst is investigating SIEM alert correlation logs for an internal endpoint with IP address 10.0.4.112. The log collector correlates recursive DNS resolver logs with outbound NetFlow records as shown below:

2026-07-27T11:02:14Z DNS_RESOLV src=10.0.4.112 qtype=TXT qname=a9f1b.data-sync-update.com rcode=NOERROR rdata="ZXhoYWlsZV9jMg=="
2026-07-27T11:03:14Z DNS_RESOLV src=10.0.4.112 qtype=TXT qname=c3k8p.data-sync-update.com rcode=NOERROR rdata="dHJhbnNtaXRfZGF0YQ=="
2026-07-27T11:04:14Z DNS_RESOLV src=10.0.4.112 qtype=TXT qname=e7m2q.data-sync-update.com rcode=NOERROR rdata="Y29tbWFuZF9hY2s=
2026-07-27T11:04:15Z NETFLOW_OUT src=10.0.4.112:49812 dst=203.0.113.88:443 bytes=148200 proto=TCP flags=ACK,PSH

Which of the following findings accurately interpret these network security monitoring logs and represent effective mitigation steps? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The pattern of periodic DNS TXT queries with encoded subdomain prefixes indicates DNS tunneling used for command-and-control (C2) communication or data staging.; Configuring DNS sinkholing or Response Policy Zone (RPZ) rules on the local recursive resolver provides immediate containment by blocking resolution of the malicious domain.

Cevap

The telemetry indicates DNS tunneling for command-and-control (C2) beaconing, which is best contained by implementing DNS sinkholing or Response Policy Zone (RPZ) rules.
The correct options accurately identify the threat as DNS tunneling and select the appropriate remediation. DNS tunneling encodes binary command strings into DNS subdomains and TXT record responses, providing a covert C2 channel over standard port 53 traffic. DNS sinkholing (or RPZ) is the primary containment strategy because it intercepts resolution attempts for the adversary-controlled domain at the recursive resolver level.

Adım Adım Çözüm

1
Analyze the DNS protocol behavior and query characteristics.
Identified high-frequency, randomized subdomain queries under a single domain (data-sync-update.com) requesting TXT records containing Base64-encoded strings at strict 60-second intervals.
Covert channels like DNS tunneling encode payload data into DNS subdomains or record fields to bypass perimeter firewall inspection.
2
Correlate DNS telemetry with outbound flow logs.
Confirmed outbound TCP connection spikes immediately following successful DNS TXT query responses.
The C2 agent receives instructions via DNS TXT record payloads and establishes secondary egress connections based on received commands.
3
Evaluate appropriate network monitoring containment strategies.
Select DNS sinkholing / Response Policy Zones (RPZ) at the internal resolver layer.
Sinkholing prevents the compromised host from resolving malicious C2 domains, isolating the host from external adversary control while logging blocked connection attempts.

Anahtar Kavram

DNS Tunneling Detection and DNS Sinkholing Mitigation
Tahmini Süre:2m 0s
ÖncekiSayfa 23 / 32Sonraki
Security Operations Alıştırma Soruları — CompTIA Security+ — Sayfa 23 | Examkin