Examkin

Security Operations

627 soru

Tüm türler627Çoktan seçmeli320Çoklu seçim139Eşleştirme36Sıralama132
Soru 101Soru →

A SOC analyst is reviewing diverse log artifacts collected across enterprise infrastructure. Match each security log artifact signature to the corresponding incident activity or event type it indicates.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Windows Security Event ID 4625 with Status Code 0xC000006A
HTTP 403 GET request containing `?file=../../../../etc/shadow`
NetFlow record showing high-frequency 53/UDP outbound flows with unusually large payload sizes
Linux auth.log entry: `pam_unix(sudo:auth): authentication failure; logname=jdoe uid=1001 euid=0`

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Matching pairs: (1) Windows Event ID 4625 with Status Code 0xC000006A corresponds to a failed user logon attempt due to an incorrect password. (2) HTTP GET request with path traversal characters corresponds to a directory traversal attack attempt. (3) NetFlow record with high-frequency, large UDP 53 payloads corresponds to potential DNS tunneling exfiltration. (4) Linux pam_unix sudo auth failure corresponds to an unauthorized privilege escalation attempt.
Each log snippet exhibits unique protocol and system signatures: Event ID 4625 with status 0xC000006A explicitly flags bad password logons; relative path sequences indicate directory traversal; abnormally large UDP 53 packets reflect DNS covert tunneling; and PAM sudo failure messages record elevated privilege execution blocks.

Adım Adım Çözüm

1
Analyze Windows Event ID 4625 and its status code
Identify that Event ID 4625 records failed logons, with 0xC000006A denoting bad password entry.
Correlating event codes with specific Windows sub-status codes allows precise identification of authentication failure causes.
2
Inspect the web server access log string syntax
Recognize path manipulation patterns (`../`) pointing to sensitive system paths (`/etc/shadow`).
Dot-dot-slash characters are characteristic signature elements of directory/path traversal vulnerabilities.
3
Evaluate NetFlow protocol indicators
Associate large outbound UDP port 53 payloads with covert channel exfiltration.
DNS relies on UDP port 53 and normally transmits minor metadata; anomaly detection identifies large payload bursts as tunneling.
4
Examine Linux authentication daemon log entries
Connect `pam_unix(sudo:auth)` failure logs to elevated privileges execution attempts.
The `sudo` command allows standard users to run tasks with effective UID 0 (root), making failed sudo attempts indicators of unauthorized privilege escalation.

Anahtar Kavram

Log Analysis and Event Correlation
Soru 102Soru →

A security analyst is reviewing authentication logs from a Linux server (`/var/log/auth.log`) after a SIEM alert fired:

May 12 14:02:11 auth-srv sshd[4102]: Failed password for root from 192.0.2.45 port 49152 ssh2
May 12 14:02:14 auth-srv sshd[4102]: Failed password for root from 192.0.2.45 port 49154 ssh2
May 12 14:02:17 auth-srv sshd[4102]: Failed password for root from 192.0.2.45 port 49156 ssh2
May 12 14:02:22 auth-srv sshd[4102]: Accepted password for root from 192.0.2.45 port 49160 ssh2
May 12 14:02:23 auth-srv pam_unix(sshd:session): session opened for user root by (uid=0)

Based on the log snippet above, which of the following statements regarding the incident and appropriate response actions are correct? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The event sequence demonstrates a successful password brute-force attack resulting in account compromise.; The affected host should be immediately isolated from the network as part of incident containment.

Cevap

The correct conclusions are that the event sequence demonstrates a successful password brute-force attack resulting in account compromise, and the affected host should be immediately isolated from the network as part of incident containment.
The sequence of multiple failed password attempts from IP 192.0.2.45 followed immediately by a successful login for the root user indicates a successful brute-force attack. Because privileged access (root) was established by an untrusted source, the immediate incident response action is system containment via network isolation.

Adım Adım Çözüm

1
Analyze the log entries chronologically to determine the pattern of activity.
Three consecutive failed password attempts for user 'root' from source IP 192.0.2.45 occur within seconds, followed directly by an 'Accepted password' entry from the same IP.
Rapid consecutive authentication failures followed by success indicate automated credential guessing (brute-force attack).
2
Determine the impact of the successful authentication entry.
The root session was opened (`session opened for user root`), confirming unauthorized administrative access.
Root access gives full privilege on a Linux system, making containment an urgent priority.
3
Identify the immediate incident response containment action.
Isolate the compromised system from the local network.
Host network isolation prevents the attacker from escalating privileges laterally across the network.

Anahtar Kavram

Identifying brute-force authentication indicators in log files and determining immediate incident containment steps.
Soru 103Soru →

A Security Operations Center (SOC) analyst receives a validated alert indicating unauthorized administrative credential usage and potential persistence mechanisms on a critical internal server. According to standard incident response frameworks and playbooks, the analyst must focus on immediate containment and evidence preservation. Which of the following actions should the analyst perform at this stage? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Place the affected server into an isolated quarantine VLAN to prevent lateral movement while preserving volatile state.; Capture a full image of volatile memory (RAM) to preserve active network connections and running process artifacts.

Cevap

The analyst should isolate the server on a quarantine VLAN and capture a full image of volatile memory (RAM).
Isolating the compromised host on a quarantine VLAN halts lateral network movement while keeping the system powered, allowing analysts to capture volatile memory (RAM) to preserve ephemeral evidence such as running processes and active sockets before it is lost.

Adım Adım Çözüm

1
Identify the active incident response phase requested in the scenario.
The scenario requires executing immediate containment and evidence preservation procedures.
Standard NIST and ISO incident response lifecycles mandate containing threats and securing volatile evidence before eradication or recovery.
2
Evaluate the choices to find actions that fulfill containment and preservation requirements.
Quarantining the network connection contains the attack, while RAM acquisition preserves volatile memory artifacts.
Placing the machine in a quarantine VLAN halts lateral movement without shutting down the host, allowing RAM to be captured following the order of volatility.
3
Eliminate options corresponding to out-of-order lifecycle phases.
Reimaging (eradication) and post-incident lessons learned (post-incident activity) are misaligned with initial containment.
Executing eradication or post-incident review steps out of sequence compromises forensic evidence and operational integrity.

Anahtar Kavram

Incident Response Containment and Evidence Preservation Lifecycle Phases
Soru 104Soru →

During a suspected breach investigation, a security handler observes that an API gateway server hosting sensitive internal workflows is attempting unauthorized outbound network traffic to a known command-and-control server following a successful zero-day exploit execution. According to standard NIST incident response guidelines, which of the following actions should the handler execute FIRST?

Cevabı ve açıklamayı göster

Cevap: Isolate the API gateway server from the network via microsegmentation to prevent data exfiltration while preserving system volatile memory.

Cevap

Isolate the API gateway server from the network via microsegmentation to prevent data exfiltration while preserving system volatile memory.
In accordance with standard NIST incident response frameworks (NIST SP 800-61), once an active intrusion or C2 communication is confirmed, containment must occur before eradication or recovery steps. Isolating the system via microsegmentation halts outbound data exfiltration and lateral movement while keeping the system in a state suitable for volatile memory capture and forensic analysis.

Adım Adım Çözüm

1
Identify the current incident response phase based on the scenario description.
The incident has been detected and confirmed active (active C2 communication), placing the handler at the transition into the Containment, Eradication, and Recovery phase.
Before performing active system modifications, the immediate priority is limiting breach scope and preventing exfiltration.
2
Evaluate containment actions against eradication and recovery actions.
Network isolation contains the threat immediately without altering host volatile memory needed for forensic capture.
Standard NIST SP 800-61 frameworks dictate containing the incident prior to executing eradication steps like deleting malicious binaries or performing host imaging.
3
Select the correct immediate next step.
Isolating the server using microsegmentation or host isolation controls is the required first response action.
This halts attacker interaction while preserving system state for evidence preservation.

Anahtar Kavram

Incident Response Lifecycle Order (Containment before Eradication/Recovery)
Soru 105Soru →

A security analyst is reviewing the following Linux authentication and system logs aggregated by an enterprise SIEM platform from host `srv-prod-02`:

syslog
2026-07-27T10:14:02Z srv-prod-02 sshd[8812]: Failed password for invalid user admin from 192.0.2.140 port 51102 ssh2
2026-07-27T10:14:05Z srv-prod-02 sshd[8815]: Failed password for invalid user root from 192.0.2.140 port 51106 ssh2
2026-07-27T10:14:12Z srv-prod-02 sshd[8820]: Accepted password for user svc_web from 192.0.2.140 port 51112 ssh2
2026-07-27T10:14:25Z srv-prod-02 sudo[8840]: svc_web : TTY=pts/1 ; PWD=/var/www/html ; USER=root ; COMMAND=/usr/bin/python3 -c 'import pty; pty.spawn("/bin/sh")'

Based on the SIEM event sequence above, which of the following statements correctly analyze the activity and impact of this security incident? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The initial SSH activity shows a successful authentication following multiple rapid password failures from the same source IP address.; The sequence demonstrates horizontal initial access transitioning into privilege escalation to superuser (root) status via sudo.

Cevap

The incident involves a successful SSH authentication following multiple failed logon attempts from the same source IP, followed by privilege escalation to root via sudo.
The log sequence traces a classic intrusion trajectory starting with brute-force authentication attempts against SSH (failed logins from IP 192.0.2.140), leading to successful authentication as 'svc_web'. Subsequently, the attacker abuses sudo privileges to spawn a root shell using a Python PTY trick, completing privilege escalation.

Adım Adım Çözüm

1
Analyze SSH authentication entries in the SIEM log snippet.
Identify multiple failed logins for invalid users ('admin', 'root') from source IP 192.0.2.140 followed by a successful login for 'svc_web' from the same IP.
This indicates a brute-force or credential stuffing attack that successfully gained initial access.
2
Analyze post-authentication command execution in the sudo logs.
Identify that account 'svc_web' executed `/usr/bin/python3 -c 'import pty; pty.spawn("/bin/sh")'` with `USER=root`.
Spawning an interactive shell via Python with sudo grants root administrative privileges, completing a privilege escalation attack vector.

Anahtar Kavram

Log Correlation & Incident Trajectory Analysis
Soru 106Soru →

A Security Operations Center (SOC) analyst receives a high-priority alert indicating that an employee workstation is actively encrypting local files and attempting outbound communication with a malicious command-and-control server. According to standard incident response procedures, which of the following steps should the analyst perform FIRST?

Cevabı ve açıklamayı göster

Cevap: Disconnect the workstation from the local network to isolate the threat.

Cevap

Disconnect the workstation from the local network to isolate the threat.
Isolating the workstation from the network is the critical first step during the containment phase of incident response. Disconnecting network access halts communication with command-and-control servers and prevents lateral movement to other enterprise endpoints.

Adım Adım Çözüm

1
Determine the current phase of the incident response lifecycle.
The scenario describes an active malware infection requiring immediate containment.
An ongoing incident must be contained immediately to limit scope and prevent further damage.
2
Select the appropriate action for host containment.
Isolating the system from the network halts command-and-control traffic and stops lateral propagation.
Network disconnection prevents the spread of ransomware/malware while leaving system state intact for initial analysis.

Anahtar Kavram

Incident Response Containment Phase
Soru 107Soru →

A security analyst is reviewing the following firewall Syslog entries forwarded to a SIEM collector:

`Jul 27 10:15:01 fw01 kernel: [FW_DROP]: IN=eth0 OUT= SRC=192.0.2.50 DST=10.0.1.10 PROTO=TCP SPT=49152 DPT=22`
`Jul 27 10:15:01 fw01 kernel: [FW_DROP]: IN=eth0 OUT= SRC=192.0.2.50 DST=10.0.1.10 PROTO=TCP SPT=49153 DPT=80`
`Jul 27 10:15:01 fw01 kernel: [FW_DROP]: IN=eth0 OUT= SRC=192.0.2.50 DST=10.0.1.10 PROTO=TCP SPT=49154 DPT=443`
`Jul 27 10:15:01 fw01 kernel: [FW_DROP]: IN=eth0 OUT= SRC=192.0.2.50 DST=10.0.1.10 PROTO=TCP SPT=3389 DPT=3389`

Which of the following network activities is best indicated by this log sequence?

Cevabı ve açıklamayı göster

Cevap: Port scanning targeting multiple standard service ports on a single host

Cevap

Port scanning targeting multiple standard service ports on a single host
The log entries show a single external source IP address (192.0.2.50) attempting connections to several well-known service ports (22 for SSH, 80 for HTTP, 443 for HTTPS, and 3389 for RDP) on a target host (10.0.1.10) at the exact same second. This pattern of rapidly probing multiple ports on a single host is the classic signature of a port scan.

Adım Adım Çözüm

1
Examine the log source and event details
Identified packet drop entries ([FW_DROP]) logged by firewall host fw01.
Understanding the log component helps isolate network traffic events from application or host events.
2
Analyze source IP, destination IP, and timestamps across entries
Source IP 192.0.2.50 sent sequential packets to destination IP 10.0.1.10 at the exact same timestamp (10:15:01).
Rapid attempts from a single source host to a target host indicate automated reconnaissance.
3
Inspect destination ports (DPT) queried
Destinations include TCP ports 22 (SSH), 80 (HTTP), 443 (HTTPS), and 3389 (RDP).
Testing multiple well-known service ports sequentially is standard behavior for network port scanners.

Anahtar Kavram

Identifying port scanning behavior from firewall log parameters in SIEM monitoring
Soru 108Soru →

A security handler confirms that a cloud administrator host is actively exporting database backups to an unapproved external storage endpoint using hijacked API credentials. Following standard incident response procedures, which of the following actions should the security handler take FIRST?

Cevabı ve açıklamayı göster

Cevap: Revoke the compromised API credentials and restrict the host's network connectivity.

Cevap

Revoke the compromised API credentials and restrict the host's network connectivity.
In standard incident response frameworks (such as NIST SP 800-61), once an active breach or exfiltration event is detected, containment is the immediate priority. Revoking compromised API keys and isolating the affected system prevents further data loss without altering offline forensic evidence.

Adım Adım Çözüm

1
Analyze the incident scenario and determine the current phase of incident response.
An active data exfiltration incident is occurring via hijacked administrative credentials.
Immediate containment is required to minimize exposure and halt ongoing unauthorized access.
2
Select the appropriate immediate containment action according to standard NIST IR playbooks.
Revoking session keys/credentials and isolating the administrator host halts exfiltration immediately.
Containment actions must precede eradication (reimaging) or recovery (restoring from backups).

Anahtar Kavram

Incident Response Lifecycle - Containment Phase
Soru 109Soru →

A security analyst is investigating a high-fidelity SIEM alert generated from cloud infrastructure audit logs. The analyst retrieves the following sequential log events originating from external IP address 198.51.100.4:

text
2026-06-14T09:12:01Z cloudtrail: User="j.smith" Event="ConsoleLogin" Status="Failure" SourceIP="198.51.100.4"
2026-06-14T09:12:03Z cloudtrail: User="m.davis" Event="ConsoleLogin" Status="Failure" SourceIP="198.51.100.4"
2026-06-14T09:12:05Z cloudtrail: User="a.wilson" Event="ConsoleLogin" Status="Failure" SourceIP="198.51.100.4"
2026-06-14T09:12:10Z cloudtrail: User="r.taylor" Event="ConsoleLogin" Status="Success" SourceIP="198.51.100.4"
2026-06-14T09:12:18Z cloudtrail: User="r.taylor" Event="CreateAccessKey" Status="Success" SourceIP="198.51.100.4"

Based on these log entries, which of the following security events has occurred?

Cevabı ve açıklamayı göster

Cevap: A password spraying attack resulted in a successful login for account r.taylor, followed by the generation of API credentials for persistence.

Cevap

A password spraying attack resulted in a successful login for account r.taylor, followed by the generation of API credentials for persistence.
The correct option accurately identifies the log signature of a password spraying attack (multiple different target accounts tested from one IP address in rapid succession) leading to account compromise and post-exploitation persistence setup via API access key creation.

Adım Adım Çözüm

1
Analyze the log entries for authentication activity patterns.
Identify that the same source IP (198.51.100.4) attempted login requests across multiple distinct user accounts (j.smith, m.davis, a.wilson, r.taylor) within seconds.
Sequential failed logins across multiple accounts from a single IP address indicate a horizontal brute-force technique known as password spraying.
2
Evaluate the outcome of the authentication attempts.
Account r.taylor logged in successfully at 09:12:10Z.
Determines that the password spraying attempt successfully identified a valid credential pair.
3
Correlate post-authentication actions.
Account r.taylor executed CreateAccessKey successfully 8 seconds after logging in.
Threat actors frequently create programmatic access keys immediately after account compromise to ensure persistent command-line or API access.

Anahtar Kavram

Log Correlation and Password Spraying Detection
Soru 110Soru →

A security operations team responds to an active breach involving a malicious third-party OAuth application that gained consent to access executive mailboxes in a cloud SaaS environment. The application is actively exporting sensitive financial emails via automated API calls. According to standard incident response playbooks for cloud containment, which TWO of the following actions should the team perform immediately? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Revoke all active OAuth access and refresh tokens linked to the malicious application.; Disable the application registration and revoke permissions for its service principal in the identity tenant.

Cevap

The correct containment steps are revoking active OAuth access and refresh tokens and disabling the application registration with its service principal permissions.
In cloud identity environments, containing malicious third-party OAuth app activity requires severing active API authorizations. Revoking current access and refresh tokens immediately stops ongoing session traffic, while disabling the enterprise application registration and its service principal prevents the attacker from generating fresh tokens or maintaining persistent API access.

Adım Adım Çözüm

1
Identify the vector of active exfiltration
Exfiltration is occurring via API calls using compromised OAuth tokens tied to an authorized application registration.
Containment must target the exact access vector without destroying system evidence or impacting unrelated services.
2
Invalidate existing session tokens
Revoking access and refresh tokens instantly severs current API connections established by the attacker.
Token revocation stops ongoing data transfer in real time during the containment phase.
3
Disable application credentials
Disabling the application registration and its service principal prevents the application from generating new authorization tokens.
This isolates the malicious application within the identity tenant, completing initial containment.

Anahtar Kavram

Cloud SaaS Incident Response and OAuth Application Containment
Tahmini Süre:2m 0s
Soru 111Soru →

Place the core stages of the Security Information and Event Management (SIEM) log processing pipeline in the correct sequential order from initial intake to analyst notification.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for the SIEM log processing pipeline is Log Collection, followed by Parsing and Normalization, then Event Correlation, and finally Alert Generation.
The standard SIEM data ingestion workflow begins with raw Log Collection from enterprise systems. These logs undergo Parsing and Normalization so that events from diverse operating systems and security appliances fit a common data model. Once normalized, the SIEM executes Event Correlation across logs to detect complex multi-host attack patterns. When correlation threshold rules are met, the system performs Alert Generation to notify security analysts.

Adım Adım Çözüm

1
Identify the initial data ingestion phase
Log Collection occurs first as raw logs must be collected from disparate endpoint and network sources before processing.
Downstream parsing and analysis tools require raw event data to operate.
2
Identify the data structuring phase
Parsing and Normalization occurs second to reformat incoming raw text logs into standard, structured fields.
SIEM engines require consistent field definitions across different log vendors to execute detection logic.
3
Identify the threat detection and analysis phase
Event Correlation occurs third to analyze structured logs against rule sets and baseline behaviors.
Correlation logic depends on pre-normalized fields to associate related events across different systems.
4
Identify the incident escalation phase
Alert Generation occurs last when correlation conditions indicate a potential security event.
Alerting informs analysts only after potential threat indicators have been identified and prioritized.

Anahtar Kavram

SIEM Log Processing Pipeline
Soru 112Soru →

During a routine traffic audit of an enterprise perimeter router, a security team examines the following network telemetry log generated by a passive Network Security Monitoring (NSM) sensor inspecting outbound UDP traffic:

Timestamp: 2026-07-27T14:22:01Z
Sensor_ID: NSM-PERIMETER-02
Src_IP: 10.4.18.99 (Internal Workstation)
Dst_IP: 198.51.100.45 (External Name Server)
Proto/Port: UDP/53
Query_Type: TXT
Query_String: a1b2c3d4e5f67890abcdef1234567890.sub.exfil-domain.example
Packet_Count: 14,250 queries/5 min
Avg_Payload_Size: 480 bytes

Which of the following is the most accurate assessment of the threat indicated by this alert and the security operational classification of the sensor mechanism?

Cevabı ve açıklamayı göster

Cevap: The traffic indicates network data exfiltration using DNS covert tunneling, and the monitoring sensor operates as a detective security control.

Cevap

The traffic indicates network data exfiltration using DNS covert tunneling, and the monitoring sensor operates as a detective security control.
The correct option accurately identifies the high-frequency UDP/53 TXT query anomaly as DNS covert tunneling used for exfiltrating data across network boundaries. It also correctly categorizes the passive network telemetry sensor as a detective security control because it gathers log evidence and triggers alerts without intercepting or dropping packets inline.

Adım Adım Çözüm

1
Analyze the protocol, query type, payload length, and traffic volume in the telemetry log.
The log reveals an abnormally high volume (14,250 queries within 5 minutes) of UDP port 53 TXT record requests carrying long encoded subdomains to an external destination.
Legitimate DNS resolution consists of low-volume, short lookup requests. Large payloads sent rapidly via TXT queries strongly indicate DNS tunneling used for covert data exfiltration.
2
Differentiate between database/web application exploit traffic and network-level covert tunneling.
The payload is encoded data embedded inside domain subdomains for DNS routing, not relational database manipulation queries (SQL injection).
DNS tunneling encapsulates data within protocol packets to bypass perimeter firewalls, distinct from web application injection vulnerabilities.
3
Classify the operational role of the passive Network Security Monitoring (NSM) sensor.
The passive NSM sensor observes network traffic and records telemetry/alerts, serving a detective control function.
Preventive controls block traffic inline (like firewalls or NIPS), whereas passive network monitoring mechanisms detect and report events.

Anahtar Kavram

DNS Covert Tunneling Detection and Detective Security Controls
Soru 113Soru →

An incident response team is executing a playbook following the detection of an active unauthorized remote access Trojan on an enterprise workstation. Which of the following actions represent appropriate steps to take specifically during the containment phase of the incident response lifecycle? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Isolating the compromised workstation from the local network by disabling its network interface; Blocking the remote command-and-control server's IP address at the perimeter firewall

Cevap

The correct containment steps are isolating the compromised workstation from the local network by disabling its network interface, and blocking the remote command-and-control server's IP address at the perimeter firewall.
The containment phase aims to limit the blast radius of a confirmed security incident. Isolating the workstation from the network stops malware from spreading laterally across internal segments. Blocking command-and-control IP addresses at the firewall halts outbound control channels and data exfiltration while keeping evidence intact.

Adım Adım Çözüm

1
Determine the core purpose of the containment phase in the incident response framework.
Containment focuses on restricting the spread of an active incident and mitigating damage while keeping systems stable and preserving evidence.
Stopping lateral movement and external C2 communications isolates the risk before permanent removal or rebuilding steps begin.
2
Map each option to its appropriate incident response lifecycle phase.
Host network isolation and perimeter firewall blocking limit breach scope (Containment). System reimaging purges the malware (Eradication). Post-incident reviews document lessons learned (Post-Incident Activity).
Distinguishing containment actions from eradication and post-incident activities ensures proper operational sequencing according to NIST SP 800-61 guidelines.

Anahtar Kavram

Incident Response Containment Strategies
Soru 114Soru →

A security analyst investigating a cloud-hosted infrastructure detects that an OAuth 2.0 refresh token assigned to an automated microservice was compromised. Real-time monitoring confirms an unauthorized external entity is actively exploiting this token to execute bulk queries and exfiltrate sensitive financial records from a database endpoint. According to standard incident response lifecycle frameworks, which of the following represents the IMMEDIATE next step the incident response team should take?

Cevabı ve açıklamayı göster

Cevap: Revoke the compromised API access token and apply temporary network isolation rules to halt active data exfiltration.

Cevap

Revoke the compromised API access token and apply temporary network isolation rules to halt active data exfiltration.
The correct response prioritizes containment above eradication and recovery during an active security incident. In standard frameworks (such as NIST SP 800-61), once an incident is detected and validated, the immediate priority is limiting the scope of impact and preventing further exfiltration. Revoking the compromised OAuth token invalidates the active credential, while temporary network isolation prevents further unauthorized API interaction.

Adım Adım Çözüm

1
Analyze the current state of the security incident based on scenario telemetry.
Identified active data exfiltration occurring via a compromised OAuth token.
Determining whether an active threat is in progress dictates the immediate priority in the incident response process.
2
Determine the appropriate incident response phase according to standard NIST SP 800-61 / ISO 27035 guidelines.
The incident is actively occurring, requiring immediate Containment.
The priority during active breach scenarios is to limit damage and prevent further unauthorized data movement before initiating remediation.
3
Select the response action that fulfills the containment objective.
Revoking the compromised token and isolating the affected endpoint stops ongoing data leakage immediately.
Invalidating stolen active session/token credentials and isolating network pathways directly halts unauthorized data access without jumping ahead to eradication or recovery.

Anahtar Kavram

Incident Response Lifecycle Containment Phase Priorities
Soru 115Soru →

A security operations engineer is responding to an incident where an attacker maintained access to enterprise cloud resources after an employee reported a compromised password. The security analyst immediately performed a password reset, but log reviews show the attacker continued performing administrative actions using an active Single Sign-On (SSO) session and active refresh tokens for several hours afterward. Which of the following operations should the security team perform to remediate this vulnerability and ensure immediate containment during credential resets?

Cevabı ve açıklamayı göster

Cevap: Enforce automated active session revocation and token invalidation workflows upon password resets.

Cevap

Enforcing automated active session revocation and token invalidation workflows upon password resets.
When a password reset occurs, modern SSO identity providers must explicitly revoke issued session tokens and refresh tokens (such as OAuth tokens or SAML session keys). Without explicit token revocation, active sessions remain valid until their scheduled time-to-live (TTL) expires, allowing unauthorized access to persist.

Adım Adım Çözüm

1
Analyze the incident evidence to determine how persistent access occurred.
Identified that password resetting alone left existing JSON Web Tokens (JWTs) and active SSO session cookies valid until their natural expiration.
Authentication protocols (OAuth 2.0/OIDC/SAML) decouple credential verification from session token lifecycles unless explicit revocation signals are sent.
2
Evaluate identity operational controls to force session termination across connected applications.
Automating session revocation invalidates all issued access and refresh tokens immediately upon credential change.
This prevents malicious actors from continuing to use cached identity tokens after authentication credentials are rotated.

Anahtar Kavram

Identity and Access Management Operations - Session Lifecycle and Token Revocation
Soru 116Soru →

An IT auditor inspects syslog entries forwarded to an enterprise SIEM aggregator from a Linux server. The log stream records the following sequential events:

`2026-07-27T14:15:02Z host1 sshd[4821]: Failed password for invalid user root from 198.51.100.45 port 42102 ssh2`
`2026-07-27T14:15:03Z host1 sshd[4825]: Failed password for invalid user admin from 198.51.100.45 port 42104 ssh2`
`2026-07-27T14:15:04Z host1 sshd[4830]: Failed password for invalid user service from 198.51.100.45 port 42108 ssh2`

Which malicious activity is most directly demonstrated by these log entries?

Cevabı ve açıklamayı göster

Cevap: A brute-force authentication attack targeting system account names

Cevap

A brute-force authentication attack targeting system account names
The correct option correctly identifies the signature of an automated brute-force login attack. The syslog output captures sequential authentication failures from a single remote host testing multiple standard user accounts in rapid succession.

Adım Adım Çözüm

1
Analyze the log source and process daemon
The entries come from sshd handling Secure Shell login requests
Identifies the core service receiving inbound traffic
2
Examine patterns in timestamps, source IPs, and status messages
Multiple failed attempts occur within seconds from IP 198.51.100.45 trying common administrative usernames
Rapid successive failures for different accounts from one origin indicate password guessing or brute-force scanning

Anahtar Kavram

Log Analysis and SIEM Management
Tahmini Süre:45s
Soru 117Soru →

An incident response specialist is preparing to collect evidence from an active, powered-on server involved in a security incident. In what sequence should the specialist acquire the following digital evidence sources to strictly adhere to the Order of Volatility, moving from most volatile to least volatile?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order from most volatile to least volatile is: CPU cache and registers, System Random Access Memory (RAM), Temporary swap space and pagefiles, and Local solid-state or hard disk drive storage.
Digital evidence acquisition must follow the Order of Volatility to prevent the loss of ephemeral data. The standard sequence begins with ultra-transient CPU cache and registers, proceeds to live system RAM, moves to temporary disk swap/pagefile space, and finishes with non-volatile local disk storage.

Adım Adım Çözüm

1
Identify the data source with the shortest life expectancy.
CPU cache and registers are identified as the most volatile.
CPU registers and memory caches alter content with every clock cycle and instruction execution.
2
Identify active dynamic system memory.
System Random Access Memory (RAM) is placed second.
RAM holds volatile runtime environment details that vanish if power is disconnected or the operating system halts.
3
Identify secondary virtual memory files stored on disk.
Temporary swap space and pagefiles are placed third.
Swap/pagefiles contain memory artifacts written to storage, changing regularly during system operation but less ephemeral than physical RAM.
4
Identify non-volatile persistent storage media.
Local solid-state or hard disk drive storage is placed fourth.
Disk drives store non-volatile data that remains intact even after a system is powered off.

Anahtar Kavram

Order of Volatility (RFC 3227)
Soru 118Soru →

A security operations team has confirmed a active malware infection on a financial database administrator's workstation. Arrange the incident response playbook actions in the correct chronological order from first to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence begins with host network isolation (containment), followed by volatile memory acquisition (forensics/preservation), followed by system sanitization and image restoration (eradication/recovery), and concludes with the post-incident review (lessons learned).
According to NIST SP 800-61 standards, once an incident is confirmed, the immediate step is Containment (isolating the host from the network). Next comes Evidence Preservation (capturing volatile RAM while the machine is running). Following evidence collection, Eradication and Recovery take place (removing malware and re-imaging from clean media). Finally, Post-Incident Activities (lessons learned) occur once operations return to normal.

Adım Adım Çözüm

1
Isolate the infected host from the enterprise network.
Containment is achieved, halting active command-and-control communication and lateral propagation.
Immediate containment stops potential compromise progression before pursuing offline analysis.
2
Acquire volatile memory evidence prior to system shutdown.
RAM memory dump and volatile system state are preserved for investigation.
Volatile data resides in RAM and will be permanently lost if the machine is powered off or rebooted during remediation.
3
Perform eradication of threat artifacts and execute recovery procedures.
Malware persistence is removed and the system is safely restored to operational status from a verified baseline.
Eradication ensures the environment is clean before returning the system to production.
4
Hold a post-incident review and update documentation.
Lessons learned are compiled into an incident report to improve security operations.
Post-incident analysis evaluates performance metrics and identifies playbook improvements for future incidents.

Anahtar Kavram

NIST Incident Response Lifecycle (Containment, Evidence Preservation, Eradication/Recovery, Lessons Learned)
Soru 119Soru →

During a routine SOC escalation, an analyst discovers that a compromised staging CI/CD build server is executing unauthorized outbound SSH tunnels to an external IP address while pulling credentials from an internal vault. The server maintains active service accounts with administrative privileges to production clusters. Following standard NIST SP 800-61 incident response guidelines, which of the following actions should the analyst perform FIRST?

Cevabı ve açıklamayı göster

Cevap: Isolate the build server from the network and revoke the associated service account credentials.

Cevap

Isolate the build server from the network and revoke the associated service account credentials.
The correct action prioritizes the containment phase of the incident response lifecycle. Disconnecting the compromised system from the network and revoking elevated service credentials immediately mitigates the risk of lateral movement into production environments and halts active exfiltration.

Adım Adım Çözüm

1
Identify the current incident response phase based on the scenario indicators.
The incident is actively occurring with ongoing unauthorized outbound traffic and lateral movement risk.
Determining the phase ensures adherence to standard incident handling frameworks (NIST SP 800-61 / ISO 27035).
2
Select the immediate containment step to stop active impact.
Network isolation of the host and revocation of compromised staging/production service accounts.
Containment limits the scope of damage and prevents attackers from pivoting into production before eradication begins.

Anahtar Kavram

Incident Response Containment Phase Priority
Soru 120Soru →

A Security Operations Center (SOC) analyst is evaluating DNS server query logs forward-collected by a SIEM platform after an internal endpoint exhibited anomalous egress bandwidth usage. The analyst extracts the following sample log entries from internal host 10.0.12.85 over a brief period:

text
2026-07-27T08:14:02Z client 10.0.12.85#49152 query: v1-dGhpcyBpcyBhIHRlc3Q.data.corp-update.net IN TXT + (10.0.0.2)
2026-07-27T08:14:05Z client 10.0.12.85#49153 query: v1-c2VjcmV0IGRvY3VtZW50.data.corp-update.net IN TXT + (10.0.0.2)
2026-07-27T08:14:09Z client 10.0.12.85#49154 query: v1-ZXhmaWx0cmF0ZWQgZGF0YQ.data.corp-update.net IN TXT + (10.0.0.2)

Standard volume-based DNS threshold alerts failed to trigger because the query frequency remained low. Which of the following SIEM correlation rule enhancements would be MOST effective for detecting this specific exfiltration technique while minimizing false positives?

Cevabı ve açıklamayı göster

Cevap: Incorporate string entropy calculation and subdomain length evaluation combined with high unique TXT query ratios directed toward external second-level domains.

Cevap

Incorporate string entropy calculation and subdomain length evaluation combined with high unique TXT query ratios directed toward external second-level domains.
The provided log snippet shows Base64-encoded strings placed within the host portion of DNS TXT queries targeting an external domain name. Because adversaries slow down request rates to evade basic query volume alerts, effective SIEM rules must evaluate statistical properties of the log data—specifically high character entropy (randomness), unusually long subdomain lengths, and high ratios of unique subdomains to a single domain destination.

Adım Adım Çözüm

1
Analyze the log entries for specific structural patterns.
The queries feature highly variable, randomized prefixes (e.g., 'dGhpcyBpcyBh...') prepended to a common base domain ('data.corp-update.net') requesting TXT records.
This structural pattern indicates Base64-encoded payload fragments being transmitted outbound via DNS queries (DNS tunneling/data exfiltration).
2
Evaluate why standard SIEM correlation rules (volume thresholds) failed.
The query intervals (3–4 seconds apart) fall well below standard high-frequency burst detection metrics.
Adversaries intentionally throttle requests to bypass simplistic volumetric rate alerts.
3
Determine the optimal SIEM detection metric for low-and-slow DNS tunneling.
Calculating Shannon entropy (randomness of string characters), checking long subdomain labels, and tracking high counts of unique subdomains per domain name effectively flags encoded exfiltration payloads.
Encoded strings have significantly higher entropy than standard human-readable domain names, providing high detection fidelity with minimal false positives.

Anahtar Kavram

DNS Tunneling Detection and SIEM Rule Tuning
ÖncekiSayfa 6 / 32Sonraki
Security Operations Alıştırma Soruları — CompTIA Security+ — Sayfa 6 | Examkin