Security Operations

627 soru

Tüm türler627 Çoktan seçmeli320 Çoklu seçim139 Eşleştirme36 Sıralama132

An enterprise Security Operations Center (SOC) team is configuring an automated playbook within their Endpoint Detection and Response (EDR) solution to respond to an active ransomware outbreak involving credential dumping and process injection. Place the incident response steps in the correct operational order from initial containment through complete host restoration.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The proper operational sequence begins with network isolation via the EDR agent, followed by volatile memory collection, process tree termination and token revocation, enterprise-wide IOC block rule propagation, and finally system integrity remediation prior to network restoration.

The correct sequence prioritizes halting threat spread first through EDR agent network isolation, preserving perishable volatile memory next before process termination, killing active malicious code execution third, deploying global block rules to protect other network assets fourth, and finally cleaning host artifacts before restoring network connectivity.

Adım Adım Çözüm

Isolate the endpoint network connection via EDR software filters.

Halts lateral spread and data exfiltration instantly while keeping EDR communication open.

Immediate containment is mandatory prior to evidence collection or termination.

Acquire volatile memory image (RAM capture).

Preserves volatile injected DLLs, unwritten encryption keys, and active process handles.

Terminating malicious processes prior to memory capture permanently destroys critical forensic artifacts.

Kill malicious process tree and revoke associated session credentials.

Stops threat execution on the endpoint.

Active threat execution must be halted once volatile forensic data is secured.

Propagate newly identified file hashes and network indicators to the global EDR tenant block list.

Protects all uncompromised endpoints across the organization.

Global containment prevents lateral reinfection across non-isolated endpoints.

Remediate modified system binaries, verify baseline integrity, and remove host network isolation.

Returns the endpoint safely to normal operational status.

Host un-isolation should only occur after complete cleanup and integrity verification.

Anahtar Kavram

EDR Incident Response Playbook Sequencing

Soru 62Soru →

An enterprise Endpoint Detection and Response (EDR) system alerts a security analyst to an active malicious code injection on a user workstation. Sequence the standard EDR response steps from initial detection to host restoration.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with initial behavioral detection and alerting, followed by immediate endpoint network isolation, process termination and forensic telemetry collection, and concludes with host restoration.

The proper incident response workflow following an EDR alert begins with detection, moves immediately to containment (host network isolation), proceeds to eradication and evidence capture (terminating processes and dumping memory), and finishes with recovery (restoring endpoint network access).

Adım Adım Çözüm

Identify initial threat detection

The EDR agent flags anomalous activity and alerts analysts.

Incident response workflows begin with detection and triage.

Contain the threat

Network isolation is applied to the workstation via EDR.

Immediate containment prevents lateral spread while maintaining management connectivity.

Eradicate and analyze

Malicious processes are killed and process/memory telemetry is gathered.

Stopping threat activity and capturing volatile evidence enables root cause analysis without losing host context.

Restore host operations

The endpoint is verified secure and un-isolated.

Host network access is restored only after containment, investigation, and cleanup are complete.

Anahtar Kavram

EDR Incident Containment and Response Sequence

Soru 63Soru →

A system administrator notifies the incident response team after discovering that a critical internal database server containing confidential customer records is actively opening outbound connections to an unknown remote IP address. Endpoint monitoring confirms an unauthorized background process executing with administrative privileges and sending encrypted data packages outside the enterprise network boundary. According to standard incident response frameworks, which of the following actions should the team take FIRST?

Isolate the affected database server from the network segment to halt active data exfiltration.

Re-image the database server operating system and restore data from the latest clean offline backup.

Deploy a detective intrusion detection rule to observe and log future unauthorized database connections.

Execute a full antivirus scan to neutralize self-replicating network worm components across adjacent hosts.

Cevabı ve açıklamayı göster

Cevap: Isolate the affected database server from the network segment to halt active data exfiltration.

Cevap

Isolate the affected database server from the network segment to halt active data exfiltration.

According to the NIST SP 800-61 Incident Response framework, once an incident involves active data exfiltration or command-and-control activity, the immediate next phase is Containment. Isolating the server from the network stops active data exfiltration while preserving system state and volatile RAM for digital forensic analysis.

Adım Adım Çözüm

Identify the current phase of the Incident Response lifecycle based on the scenario.

The incident is actively occurring with ongoing data exfiltration detected.

Determining the phase ensures appropriate incident response playbook procedures are followed.

Select the immediate response priority following Detection and Analysis.

Containment must be executed prior to eradication or recovery.

The primary objective during active exfiltration is to minimize damage and prevent further unauthorized data transfer.

Determine the containment action that halts network communication without destroying volatile forensic evidence.

Network isolation detaches the compromised host from the network while preserving RAM and system logs.

Disconnecting or isolating network access stops malicious C2/exfiltration traffic while keeping volatile evidence intact for investigators.

Anahtar Kavram

Incident Response Containment Phase

Tahmini Süre:1m 30s

Soru 64Soru →

A Incident Response Team is responding to an ongoing breach where an adversary compromised an automated CI/CD pipeline build runner service account. The attacker injected malicious code into build scripts and is actively exfiltrating deployment credentials over an encrypted tunnel. Playbook analysis indicates the attack payload includes an automated anti-forensic wiper script that triggers upon service account termination or system reboot. Which TWO of the following immediate actions should the incident response handler perform to isolate the threat and preserve volatile evidence? (Select TWO.)

Geçerli olan tümünü seçin

Apply a hypervisor-level network isolation filter to block network traffic from the build runner host while keeping the virtual machine powered on.

Perform a volatile memory (RAM) capture of the compromised build runner system prior to terminating active sessions or credentials.

Immediately reboot the host into single-user recovery mode to kill active adversary process trees and run an offline antivirus scan.

Initiate an immediate host reimage using the gold deployment image to ensure complete eradication of the malicious build scripts.

Cevabı ve açıklamayı göster

Cevap: Apply a hypervisor-level network isolation filter to block network traffic from the build runner host while keeping the virtual machine powered on.; Perform a volatile memory (RAM) capture of the compromised build runner system prior to terminating active sessions or credentials.

Cevap

The incident response handlers should isolate the host at the hypervisor network boundary to cut off adversary connectivity without disturbing the operating environment, and take a full volatile RAM capture to preserve running processes and decryption keys before taking destructive actions.

Correct containment and evidence preservation strategy requires isolating the system from the network without altering volatile system state or powering off the machine. Hypervisor-level network isolation prevents command-and-control communication and data exfiltration while keeping the host active. Capturing volatile memory (RAM) prior to taking destructive actions ensures evidence integrity according to the RFC 3227 order of volatility.

Adım Adım Çözüm

Assess incident risks and order of volatility preservation constraints.

Identified that rebooting or revoking credentials immediately will trigger anti-forensic wiping scripts and destroy RAM contents.

NIST SP 800-61 Rev. 2 guidelines mandate preserving volatile evidence and preventing active exfiltration before initiating intrusive eradication tasks.

Execute non-disruptive network containment.

Network communication between the CI/CD runner host and external networks is restricted at the hypervisor layer.

Hypervisor network isolation halts C2 and data exfiltration while avoiding OS-level signal triggers that could detonate destructive payloads.

Capture volatile RAM.

System memory image acquired and cryptographically hashed for forensic integrity.

Preserves memory-resident payloads, active network sockets, and temporary credentials prior to credential revocation or host destruction.

Anahtar Kavram

Incident Containment Strategy and Order of Volatility Preservation

Soru 65Soru →

A security engineer at a utility organization oversees a fleet of distributed industrial edge gateways. Following a vendor firmware patch rollout, a security audit reveals that multiple gateways experienced configuration drift, automatically re-enabling legacy, unencrypted management protocols that violate organizational hardening standards. The engineer must implement a solution that continuously detects non-compliant settings and automatically restores all gateways to their authorized security baseline without manual intervention. Which of the following is the BEST solution to meet these requirements?

Deploy an automated configuration orchestration tool enforcing declarative baseline templates to continuously audit and remediate unauthorized setting changes.

Implement inline network intrusion prevention system signature rules to filter and drop traffic directed at the unencrypted management protocol ports.

Schedule weekly automated vulnerability assessment scans to generate detective reporting logs for analyst review and manual remediation.

Reconfigure perimeter firewall access control lists to restrict gateway management access strictly to designated jump boxes.

Cevabı ve açıklamayı göster

Cevap: Deploy an automated configuration orchestration tool enforcing declarative baseline templates to continuously audit and remediate unauthorized setting changes.

Cevap

Deploying an automated configuration orchestration tool enforcing declarative baseline templates is the best solution because it continuously monitors for configuration drift and automatically restores system settings to the authorized security baseline without manual intervention.

Deploying an automated configuration orchestration tool using declarative baseline templates directly addresses configuration drift. It continuously audits device configurations against the golden baseline standard and automatically enforces compliance by reverting unauthorized setting changes, ensuring endpoints remain hardened without requiring manual intervention.

Adım Adım Çözüm

Analyze organizational requirements

Identified the need for continuous configuration drift detection and automated remediation to enforce hardening baselines.

The scenario highlights host-level setting changes resulting from a patch deployment that must be automatically rectified.

Evaluate control types for configuration management

Configuration orchestration (such as IaC or configuration management agents) directly maintains system state against baseline templates.

Preventive and compensating network controls (NIPS, firewalls) or periodic detective tools (vulnerability scanners) do not restore local endpoint baselines automatically.

Select the optimal solution

Chosen automated configuration orchestration tool enforcing declarative templates.

This fulfills both continuous auditing and automated remediation requirements.

Anahtar Kavram

Configuration Baseline Enforcement and Automated Drift Remediation

Tahmini Süre:2m 0s

Soru 66Soru →

A security administrator at a financial institution is auditing Privileged Access Management (PAM) logs following an automated night-shift batch job failure. The log analysis reveals that a dedicated service account was locked out because a recently updated global security baseline enforced interactive multi-factor authentication (MFA) and a 30-day password expiration policy across all privileged identities. Which of the following is the MOST appropriate operational remedy to ensure unattended batch processing succeeds without compromising privileged security controls?

Migrate the process to use a Group Managed Service Account (gMSA) with automated password rotation, excluding non-interactive identities from interactive MFA enforcement rules.

Disable password expiration for the service account and assign it to the local Administrators group so that credential checks bypass identity provider authentication gates.

Relocate the database host and application servers to an isolated internal management network segment that relies on perimeter boundary isolation to trust all incoming internal connections.

Implement an automated SIEM correlation rule to detect interactive MFA failures for the account and trigger an operator approval playbook during night-shift processing.

Cevabı ve açıklamayı göster

Cevap: Migrate the process to use a Group Managed Service Account (gMSA) with automated password rotation, excluding non-interactive identities from interactive MFA enforcement rules.

Cevap

Migrate the batch process to utilize a Group Managed Service Account (gMSA) with automated password rotation while scoping interactive MFA policies strictly to human interactive logins.

Automated batch processing requires non-interactive identity controls. Group Managed Service Accounts (gMSAs) automate password management within domain environments and allow organizations to exempt service identities from interactive human prompts while maintaining strong credential protection.

Adım Adım Çözüm

Identify the operational cause of the authentication failure.

Recognize that automated non-interactive service accounts cannot fulfill interactive Multi-Factor Authentication (MFA) challenges.

Policy baselines requiring interactive prompts break automated, unattended scheduled tasks.

Evaluate identity lifecycle and IAM operational management options for service accounts.

Determine that Group Managed Service Accounts (gMSAs) or managed workload identities provide centralized, programmatic credential rotation.

gMSAs eliminate static passwords and human management overhead while fulfilling security control requirements.

Adjust Identity Provider (IdP) Conditional Access policies.

Enforce interactive MFA specifically on user identities, using non-interactive certificate-based or workload identity controls for service accounts.

Ensures strong authentication controls without breaking unattended system operations.

Anahtar Kavram

Privileged Account Lifecycle and Service Account Management

Tahmini Süre:1m 30s

Soru 67Soru →

A security analyst is configuring an internal vulnerability assessment for a enterprise web platform located behind a reverse proxy. The platform includes legacy application services that are highly sensitive to traffic spikes. The analyst needs to obtain precise host vulnerability data while preventing service outages on legacy components. Which of the following scanner configurations and techniques should the analyst implement? (Select TWO.)

Geçerli olan tümünü seçin

Utilize credentialed scanning parameters to inspect local software package registries directly on host operating systems.

Configure scan rate throttling and select non-intrusive check modules during the scan execution.

Rely on unauthenticated banner grabbing through the reverse proxy to infer backend application patch levels.

Execute automated penetration testing exploitation scripts during the discovery phase to confirm vulnerability existence.

Cevabı ve açıklamayı göster

Cevap: Utilize credentialed scanning parameters to inspect local software package registries directly on host operating systems.; Configure scan rate throttling and select non-intrusive check modules during the scan execution.

Cevap

The analyst should use credentialed scanning to examine internal package registries on hosts directly, while enabling scan rate throttling and non-intrusive checks to safeguard legacy services.

Credentialed scanning provides direct, internal access to host package managers and OS registries, yielding accurate vulnerability identification. Combining credentialed access with scan rate throttling and non-intrusive test modules ensures high detection fidelity while maintaining service stability on sensitive legacy infrastructure.

Adım Adım Çözüm

Determine the scanning method that provides high host accuracy without relying on proxy responses.

Selecting credentialed scanning allows the scanner to log into target systems and inspect local package manager databases and configurations directly.

Unauthenticated network scans behind a reverse proxy only observe front-end proxy headers, leading to high false-positive rates.

Establish operational parameters to protect fragile legacy backend systems.

Enabling scan throttling and non-intrusive vulnerability test modules prevents excessive concurrent traffic and unsafe payload delivery.

Legacy systems are vulnerable to denial-of-service conditions when exposed to high request volumes or intrusive test vectors.

Anahtar Kavram

Vulnerability scanning configuration parameters (credentialed vs unauthenticated scanning and intrusive vs non-intrusive test controls)

Tahmini Süre:1m 30s

Soru 68Soru →

An organization notices that several corporate laptops used by remote employees have failed to apply a critical operating system security patch dispatched by the patch management server. Investigation reveals that the employees continuously opted to defer the required system restart, causing their devices to fall out of compliance with the enterprise security configuration baseline. Which of the following technical controls would most effectively enforce compliance and ensure the required patch installation before granting endpoints access to internal network resources?

Configure Network Access Control posture assessment policies to isolate non-compliant devices to a remediation network until the update is installed.

Deploy a perimeter Web Application Firewall rule to inspect and block unauthorized traffic targeting the remote endpoints.

Revert the non-compliant endpoints to a pre-patch system restore point to eliminate pending restart requests.

Implement a deterrent security awareness campaign requesting users to restart their systems within 24 hours.

Cevabı ve açıklamayı göster

Cevap: Configure Network Access Control posture assessment policies to isolate non-compliant devices to a remediation network until the update is installed.

Cevap

Configure Network Access Control posture assessment policies to isolate non-compliant devices to a remediation network until the update is installed.

Network Access Control (NAC) posture assessment performs pre-admission or continuous checks on connecting devices to verify compliance with configuration baselines (such as installed OS patches and updates). Devices failing posture checks are placed in a quarantined or remediation network segment where required updates can be completed before full network access is granted.

Adım Adım Çözüm

Analyze the security operational requirement

Identified the core requirement: enforcing patch compliance and reboot completion on non-compliant endpoints before allowing access to network resources.

Remote devices falling behind on security baselines create vulnerable entry points into the enterprise network.

Evaluate technical controls for posture evaluation and enforcement

Network Access Control (NAC) posture checking validates patch status, antivirus signatures, and configurations during host connection.

If an endpoint fails the health check (posture assessment), NAC can restrict access or place the device into a quarantined remediation VLAN where patches and restarts are executed automatically.

Distinguish between technical enforcement and administrative or misapplied controls

Select the NAC posture assessment control over WAF rules, system rollbacks, or administrative reminders.

NAC provides automated technical enforcement directly aligned with patch management and host configuration baseline compliance.

Anahtar Kavram

Endpoint Posture Assessment and Remediation via Network Access Control (NAC)

Tahmini Süre:1m 30s

Soru 69Soru →

A security analyst reviewing a Security Information and Event Management (SIEM) log aggregator observes the following consecutive Kerberos event entries generated by internal endpoint `10.0.12.88` within a 90-second time window:

Based on the log output, which attack technique is taking place, and what correlation rule condition should the analyst configure in the SIEM to detect this activity?

Kerberoasting; configure a correlation rule that triggers when a single source IP generates multiple Event ID 4769 Ticket Granting Service (TGS) requests requesting RC4 encryption (0x17) for Service Principal Names (SPNs) within a short time threshold.

Password spraying; configure a correlation rule that triggers on a high frequency of Event ID 4768 Authentication Ticket requests returning error code 0x18 across multiple user accounts.

Golden Ticket attack; configure a correlation rule that triggers when Kerberos tickets are granted without prior user authentication in the active directory logs.

Pass-the-Hash attack; configure a preventive SIEM automated response rule to block NTLM authentication traffic across internal network segments.

Cevabı ve açıklamayı göster

Cevap: Kerberoasting; configure a correlation rule that triggers when a single source IP generates multiple Event ID 4769 Ticket Granting Service (TGS) requests requesting RC4 encryption (0x17) for Service Principal Names (SPNs) within a short time threshold.

Cevap

The provided log snippet shows multiple Windows Security Event ID 4769 (Kerberos Service Ticket Request) events returning status code 0x0 (Success) within a 90-second window. All requests target service accounts (`svc_*`) with SPNs and explicitly request encryption type `0x17` (RC4-HMAC). This pattern is characteristic of Kerberoasting, an attack where an adversary requests Kerberos service tickets for accounts with SPNs to extract the ticket hashes from memory and attempt offline password cracking. Effective SIEM detection requires creating a correlation rule that flags a single IP or user requesting multiple 4769 events with RC4 (0x17) encryption over a short time threshold.

Adım Adım Çözüm

Analyze the event codes and fields in the log entries.

Identified Event ID 4769 (A Kerberos service ticket was requested) with successful status 0x0, target users designated as service accounts (`svc_*`), and ticket encryption type 0x17.

Event ID 4769 logs specifically track TGS ticket requests submitted to Domain Controllers for accessing resources bound to Service Principal Names (SPNs).

Evaluate the encryption type indicator (`0x17`).

Recognized `0x17` as the cipher identifier for legacy RC4-HMAC encryption in Windows Kerberos implementations.

Attacking tools (such as Rubeus or GetUserSPNs.py) explicitly request RC4 encryption because RC4-HMAC password hashes are significantly faster to crack offline using brute-force tools compared to AES-128/256.

Correlate the observed pattern to determine the attack vector and detection strategy.

Rapid sequential TGS requests for multiple service accounts requesting legacy RC4 encryption from a single host indicates a Kerberoasting reconnaissance/extraction phase. A SIEM correlation rule looking for multiple Event ID 4769 events with encryption type 0x17 within a short time frame directly identifies this threat.

Normal enterprise traffic utilizes modern AES encryption for Kerberos tickets unless legacy constraints exist; rapid bursts of RC4-encrypted TGS requests across diverse SPNs are a signature indicator of Kerberoasting.

Anahtar Kavram

Kerberoasting Log Analysis and SIEM Correlation Rule Logic

Soru 70Soru →

A security engineer is optimizing the vulnerability assessment program for a enterprise high-frequency transaction cluster located behind inline firewalls and web application firewalls (WAFs). Non-credentialed network scans previously returned zero high-severity findings, but network traffic analysis revealed several outdated service daemons running on internal nodes. The engineer must obtain accurate, detailed patch level and configuration data across all hosts while preventing latency spikes, network congestion, and false-positive results caused by network security controls. Which of the following assessment strategies should the engineer implement to meet these requirements?

Deploy local agent-based vulnerability scanners on each cluster host to execute authenticated system checks directly on the endpoints.

Configure aggressive network-based credentialed scans via SSH and WMI traversing the inline WAF during peak traffic hours.

Temporarily disable inline firewall rules and execute intrusive exploitation scripts to confirm remote shell access vulnerabilities.

Run automated web application security scanners targeting client-side Cross-Site Scripting (XSS) payloads against backend database daemons.

Cevabı ve açıklamayı göster

Cevap: Deploy local agent-based vulnerability scanners on each cluster host to execute authenticated system checks directly on the endpoints.

Cevap

Deploy local agent-based vulnerability scanners on each cluster host to execute authenticated system checks directly on the endpoints.

Deploying agent-based vulnerability scanners is the most effective approach for high-availability, low-latency production environments. Agents execute authenticated audits directly on the host operating system, providing complete visibility into missing security patches, registry settings, and local software inventories without generating network traffic spikes or being impacted by inline network firewalls and WAFs.

Adım Adım Çözüm

Analyze the operational constraints and requirements of the environment.

Identified high-frequency transaction cluster requiring zero latency impact, minimal network overhead, and immunity to network security control interference (firewalls/WAFs).

Network-based scanning can be blocked, throttled, or distorted by inline network security controls and can introduce latency.

Compare credentialed scanning methods (network-based credentialed vs. agent-based).

Agent-based scanners execute locally on host OS resources, leveraging local administrative context without generating heavy network scan traffic.

Local agents provide deep visibility into patch levels and local configurations while bypassing network security boundaries safely.

Select the optimal vulnerability scanning architecture.

Agent-based scanning satisfies all requirements by ensuring accurate vulnerability identification without network performance degradation.

It addresses both the failure of non-credentialed scans and the performance/firewall constraints of network-based scanning.

Anahtar Kavram

Agent-Based vs. Network-Based Credentialed Vulnerability Scanning

Tahmini Süre:2m 0s

Soru 71Soru →

A security operations team is reviewing credentialed vulnerability scan reports for an enterprise hybrid cloud architecture. The report reveals missing operating system kernel security patches on high-availability backend database servers and unvalidated input parameters on public-facing web API endpoints. To address these findings effectively while preventing service interruption and maintaining security integrity, which of the following actions should the team implement? (Select TWO.)

Geçerli olan tümünü seçin

Apply operating system kernel updates using rolling node restarts during off-peak scheduled maintenance windows.

Deploy web application firewall input sanitization rules to block malicious parameter payloads at the API boundary.

Execute automated intrusive exploit modules against the database cluster during production hours to confirm patch necessity.

Reclassify identified API input parameter vulnerabilities as detective security controls to satisfy compliance audits.

Cevabı ve açıklamayı göster

Cevap: Apply operating system kernel updates using rolling node restarts during off-peak scheduled maintenance windows.; Deploy web application firewall input sanitization rules to block malicious parameter payloads at the API boundary.

Cevap

The correct actions are applying operating system kernel updates using rolling node restarts during off-peak maintenance windows and deploying web application firewall input sanitization rules at the API boundary.

Remediating database kernel vulnerabilities through rolling restarts ensures that nodes receive required security patches sequentially without taking down the entire database cluster. Concurrently, deploying web application firewall parameter sanitization rules provides virtual patching at the API perimeter to protect against input manipulation attacks.

Adım Adım Çözüm

Analyze the vulnerability scan findings and host environments.

Identified two distinct issues: system-level kernel flaws on database hosts and application-level input parameter flaws on web API endpoints.

Remediation strategies must address both system and application layers independently while respecting uptime requirements.

Select appropriate remediation and mitigation strategies for high-availability database infrastructure.

Rolling updates maintain cluster availability while applying OS patches during maintenance windows.

Host patching addresses the root cause of OS vulnerabilities without incurring total cluster downtime.

Select appropriate edge security controls for API input validation vulnerabilities.

Deploying WAF parameter sanitization rules filters attack payloads at the network perimeter.

WAF rules mitigate exploit vectors immediately without requiring instantaneous code refactoring.

Anahtar Kavram

Vulnerability Remediation and Compensating Controls Prioritization

Soru 72Soru →

An enterprise security team deploys an automated vulnerability scanner to conduct network-based discovery across a newly created subnet housing microservices. Although monitoring tools verify that the microservices are online and actively serving traffic, the scanner's report indicates zero active hosts were discovered on the target subnet. Which of the following best explains why the vulnerability scanner failed to identify the active hosts?

Network security controls or host firewalls on the target subnet are blocking the initial ICMP echo requests and TCP/UDP discovery probes.

The scanner was configured with a non-credentialed account, preventing it from binding to container runtime APIs during the discovery phase.

An inline Web Application Firewall (WAF) compensated for network vulnerabilities by encrypting internal container-to-container communication.

The vulnerability scanner automatically suppresses discovery alerts whenever targeted systems use dynamic IP address allocations.

Cevabı ve açıklamayı göster

Cevap: Network security controls or host firewalls on the target subnet are blocking the initial ICMP echo requests and TCP/UDP discovery probes.

Cevap

The vulnerability scanner failed to identify active hosts because network security controls or host firewalls on the target subnet dropped the ICMP echo requests and initial TCP/UDP discovery probes used during host identification.

Vulnerability scanners initiate assessments with a host discovery phase using ICMP echo requests and TCP/UDP probes to identify active targets. When firewalls or network access control lists (ACLs) silently drop these discovery packets, the scanner concludes that no hosts are live at those IP addresses, resulting in a scan report showing zero active systems despite services running.

Adım Adım Çözüm

Analyze the scanning phase described in the scenario.

The scanner failed during the initial host discovery phase before vulnerability identification took place.

Vulnerability scanners first send lightweight network probes (ICMP, ARP, or standard TCP SYN packets to common ports) to determine if target IP addresses are alive.

Evaluate how firewalls impact network discovery probes.

Firewalls configured to drop ICMP packets and unsolicited port requests cause the scanner to register the hosts as unreachable or inactive.

When discovery probes receive no response or are silently dropped, the scanner assumes no host is bound to that IP address and skips further vulnerability assessment on those targets.

Anahtar Kavram

Host Discovery Suppressions and Firewall Interferences in Vulnerability Scanning

Soru 73Soru →

A security technician is setting up a Security Information and Event Management (SIEM) log processing pipeline. Match each SIEM log management phase to its corresponding core function.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Parsing matches extracting key data fields; Normalization matches mapping attributes into a single standardized schema; Correlation matches linking related log events across sources; Aggregation matches combining repetitive identical event records.

Each SIEM log processing stage performs a distinct function: Parsing extracts structured data fields from raw logs; Normalization maps extracted data to a standardized schema; Correlation connects multiple event streams using logic rules to detect security incidents; and Aggregation deduplicates log volume.

Adım Adım Çözüm

Identify the data extraction phase

Parsing separates unstructured log lines into discrete elements like IP addresses and event IDs.

SIEM parsers read raw log strings and extract structured fields.

Identify the standardization phase

Normalization translates varying field names from different vendors into a unified schema.

Consistent naming conventions enable effective cross-platform querying.

Identify the event analysis and rule evaluation phase

Correlation connects separate events over time to detect multi-stage attacks.

Correlation engines combine data streams from multiple sensors to trigger security alerts.

Identify the deduplication and volume reduction phase

Aggregation consolidates identical entries into a single summary record.

Grouping duplicate logs saves bandwidth and storage while reducing noise.

Anahtar Kavram

SIEM Log Processing Pipeline

Soru 74Soru →

A security analyst reviews the following web server access log entry:

192.168.1.45 - - [27/Jul/2026:14:32:10 +0000] "GET /products.php?id=1%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1" 200 4523

Which of the following attack types is indicated by this log entry?

SQL Injection (SQLi)

Cross-Site Scripting (XSS)

Broken Authorization

Rule Misconfiguration

Cevabı ve açıklamayı göster

Cevap: SQL Injection (SQLi)

Cevap

SQL Injection (SQLi)

The option identifying SQL Injection (SQLi) is correct because the URL parameter contains explicit SQL command structures ('UNION SELECT') designed to query backend database tables.

Adım Adım Çözüm

Inspect the requested URL parameters in the log entry

The parameter id contains '%20UNION%20SELECT%20username,password%20FROM%20users--'

URL decoding reveals SQL query syntax appended to the input parameter.

Identify the underlying attack mechanism

SQL keywords like UNION SELECT attempt to extract data directly from backend database tables

Manipulating backend database SQL queries via unsanitized parameter inputs defines a SQL Injection attack.

Anahtar Kavram

Identifying SQL Injection attack signatures in web access logs

Tahmini Süre:45s

Soru 75Soru →

A security analyst is configuring a new Security Information and Event Management (SIEM) solution. Place the core stages of the SIEM log processing pipeline in the correct sequential order from initial log entry to analyst notification.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of stages in a SIEM log processing pipeline is: Log Collection, Parsing, Normalization, Correlation, and Alerting.

In a standard SIEM processing pipeline, raw log data is gathered via Log Collection, extracted into data fields via Parsing, converted to a unified taxonomy during Normalization, cross-analyzed against rules during Correlation, and dispatched to analysts during Alerting.

Adım Adım Çözüm

Identify the initial log ingestion activity.

Log Collection occurs first as raw data must be received from source devices before processing.

Data cannot be parsed or analyzed until it is ingested by the SIEM collector.

Extract raw fields from collected logs.

Parsing splits unstructured log strings into discrete key-value pairs.

Specific attributes must be recognized within raw log strings before standardizing formats.

Standardize variable names and field formats.

Normalization converts heterogeneous fields into a unified system schema.

Standardized data structures allow consistent cross-source log analysis.

Evaluate normalized data against rule engines.

Correlation cross-references standardized events across different logs to identify indicators of compromise.

Pattern identification requires normalized inputs from multiple security sources.

Dispatch notification of identified incidents.

Alerting informs analysts or triggers security orchestration when correlation logic fires.

Alerting is the final outcome of pipeline processing intended to initiate human or automated incident response.

Anahtar Kavram

SIEM Log Processing Pipeline

Soru 76Soru →

A security analyst is investigating a alert on an internal Linux server and reviews the following authentication log entries:

text
Jul 27 14:10:02 auth-server sshd[4102]: Failed password for root from 203.0.113.5 port 49152 ssh2
Jul 27 14:10:03 auth-server sshd[4105]: Failed password for root from 203.0.113.5 port 49154 ssh2
Jul 27 14:10:04 auth-server sshd[4109]: Failed password for root from 203.0.113.5 port 49156 ssh2
Jul 27 14:10:05 auth-server sshd[4112]: Failed password for root from 203.0.113.5 port 49158 ssh2

Which type of security event is directly indicated by these log entries?

A Cross-Site Scripting (XSS) payload execution against a web interface

An SSH password brute-force attack against the root user account

An authorization permission failure when accessing protected files

A corrective security control automatically blocking database queries

Cevabı ve açıklamayı göster

Cevap: An SSH password brute-force attack against the root user account

Cevap

An SSH password brute-force attack against the root user account

The correct answer is correct because the SSH log entries (`sshd`) show repeated, consecutive `Failed password` messages for the privileged `root` user originating from the same source IP (`203.0.113.5`) in one-second intervals, which is a classic signature of an automated brute-force login attack.

Adım Adım Çözüm

Examine the log service process and message type.

The process `sshd` indicates Secure Shell daemon logs reporting `Failed password` for the user `root`.

Identifying the daemon and status clarifies that authentication attempts are failing.

Analyze timestamps and source address pattern.

Consecutive login failures occur every second from IP `203.0.113.5`.

Rapid, automated repeat attempts from a single source address confirm an automated password brute-force pattern.

Anahtar Kavram

SSH Authentication Log Analysis

Soru 77Soru →

During the deployment of a new Security Information and Event Management (SIEM) system, a security engineer is configuring the automated pipeline for handling enterprise security events. Arrange the stages of the SIEM data processing pipeline in the correct chronological order from initial log intake to final analyst notification.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence of the SIEM log processing pipeline is: Log Collection and Ingestion -> Parsing and Normalization -> Event Correlation -> Alert Generation and Dispatch.

The correct sequence reflects the standard data lifecycle within a SIEM: raw log streams are ingested from hosts and networks, normalized into standard field formats, evaluated by correlation logic to detect multi-event attack patterns, and finally dispatched as actionable alerts to security analysts.

Adım Adım Çözüm

Identify the initial data intake phase

Log Collection and Ingestion occurs first as raw data must be gathered from sources before processing.

Without raw log intake, no downstream parsing or analysis can occur.

Identify the data formatting phase

Parsing and Normalization occurs second to standardize field names and structures across disparate sources.

Correlation rules require standardized fields (like source IP or username) to evaluate events across different log sources.

Identify the detection and rule evaluation phase

Event Correlation occurs third as normalized data is evaluated against threat logic and correlation rules.

SIEM rules analyze relationships between parsed events to identify multi-source security incidents.

Identify the notification phase

Alert Generation and Dispatch occurs last when correlation rules trigger security alerts for SOC analysts.

Alerting is the output produced after an incident scenario is identified by correlation logic.

Anahtar Kavram

SIEM Log Processing Pipeline

Soru 78Soru →

A security analyst is investigating an automated SIEM threshold alert triggered by unusual outbound network activity from an internal host (192.168.10.114). The analyst reviews the following DNS query log entries within the SIEM dashboard:

text
27-Jul-2026 14:15:01.123 queries: info: client 192.168.10.114#49152 (a1g4z9x8q.exfil.attacker-domain.com): query: a1g4z9x8q.exfil.attacker-domain.com IN TXT +
27-Jul-2026 14:15:01.450 queries: info: client 192.168.10.114#49152 (b9k2m8p3w.exfil.attacker-domain.com): query: b9k2m8p3w.exfil.attacker-domain.com IN TXT +
27-Jul-2026 14:15:01.890 queries: info: client 192.168.10.114#49152 (c3r7v1q5n.exfil.attacker-domain.com): query: c3r7v1q5n.exfil.attacker-domain.com IN TXT +
27-Jul-2026 14:15:02.210 queries: info: client 192.168.10.114#49152 (d4m9p2k7x.exfil.attacker-domain.com): query: d4m9p2k7x.exfil.attacker-domain.com IN TXT +

Based on the log data, which of the following security events is MOST likely taking place?

DNS tunneling used for data exfiltration or command-and-control communication

Cross-Site Scripting (XSS) client-side payload execution on an internal server

Unauthorized access attempt caused by a failure in user authorization controls

Standard DNS zone transfer activity misidentified due to an overly sensitive correlation rule

Cevabı ve açıklamayı göster

Cevap: DNS tunneling used for data exfiltration or command-and-control communication

Cevap

The log entries indicate DNS tunneling used for data exfiltration or command-and-control communication.

The correct answer identifies DNS tunneling. The log snippet reveals an internal host generating rapid, high-frequency DNS queries requesting TXT records with encoded, randomized subdomains appending an external domain. Because DNS traffic often bypasses strict firewall filters, attackers encapsulate data or C2 traffic inside DNS request and response fields.

Adım Adım Çözüm

Examine the log structure and source client

Identified client host 192.168.10.114 issuing rapid, high-frequency outbound queries to an external destination domain (attacker-domain.com).

Determining the origin and frequency of requests helps distinguish automated host behavior from regular user browsing.

Analyze the query record type and hostname patterns

Queries request TXT records containing randomized/encoded alphanumeric subdomains (e.g., a1g4z9x8q.exfil...).

TXT records allow arbitrary text payload retrieval, and dynamic subdomains are commonly encoded chunks of data sent to an attacker's authoritative name server.

Correlate patterns with known threat tactics

High-volume, encoded TXT queries targeting a single sub-domain structure match the signature of DNS tunneling for covert data exfiltration or C2.

DNS traffic is often allowed through firewalls, making it an ideal vector for protocol encapsulation and stealthy data transfer.

Anahtar Kavram

DNS Tunneling Detection via SIEM Log Analysis

Soru 79Soru →

A security analyst is defining operational procedures for a Security Information and Event Management (SIEM) deployment. Match each SIEM log management concept on the left with its correct operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Log Aggregation matches centralizing raw log data from disparate hosts; Log Normalization matches transforming heterogeneous log entries into a standardized schema; Event Correlation matches analyzing relationship patterns between distinct log events; and Log Retention matches storing historical log data for specified timelines to satisfy regulatory requirements.

Each concept aligns with its precise SIEM function: Aggregation collects raw logs into a central location, Normalization standardizes field syntax across vendor logs, Correlation analyzes relationships across events to flag attacks, and Retention maintains historical log archives for compliance.

Adım Adım Çözüm

Identify the mechanism for collecting raw logs centrally.

Centralizing raw log data from disparate systems corresponds to Log Aggregation.

Aggregation brings scattered log sources together into a central SIEM collector.

Identify the process for unifying varied log formats.

Transforming heterogeneous logs into a standardized schema corresponds to Log Normalization.

Normalization ensures that different log syntax structures share identical field names (e.g., standardizing 'src_ip', 'SourceAddress', and 'src' to a single common field).

Identify the analytical process for connecting multi-system events.

Analyzing relationships across distinct log entries corresponds to Event Correlation.

Correlation engine rules detect threat scenarios spanning multiple log sources across time windows.

Identify the policy governing historic data storage.

Storing historical logs to satisfy regulatory requirements corresponds to Log Retention.

Retention schedules dictate how long logs remain accessible in hot, warm, or cold storage.

Anahtar Kavram

SIEM Core Log Management Operations

Tahmini Süre:1m 30s

Soru 80Soru →

A security analyst inspecting a Security Information and Event Management (SIEM) console reviews the following web server log snippet:

`10.0.4.15 - - [27/Jul/2026:14:15:33 +0000] "GET /cgi-bin/status.sh?cmd=cat%20/etc/passwd HTTP/1.1" 200 1420`

Which of the following cyber attack vectors is directly indicated by this log entry?

Command injection

Cross-site scripting (XSS)

SQL injection

Broken authentication

Cevabı ve açıklamayı göster

Cevap: Command injection

Cevap

The command injection option is the correct answer.

The correct answer is Command injection because the log entry shows the parameter `cmd=cat%20/etc/passwd`, where `%20` represents a space. This attempts to invoke an operating system command (`cat /etc/passwd`) on the backend web server via a CGI script.

Adım Adım Çözüm

Analyze the request URI parameters within the log entry.

Identified URL-encoded shell syntax `cat%20/etc/passwd` passed to parameter `cmd`.

Log analysis requires inspecting user input passed to CGI endpoints to determine intent.

Determine the target system and impact of the parameter payload.

The payload attempts to execute the system binary `cat` on the Linux file `/etc/passwd` directly on the web host.

Executing arbitrary operating system commands through web application inputs defines command injection.

Anahtar Kavram

Identifying web application attack indicators in SIEM access logs

ÖncekiSayfa 4 / 32Sonraki

Security Operations

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram