Incident Response

A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

During incident triage, you realize an alert is a False Positive. What is the most appropriate action to take within the SIEM ticketing system?

You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?

You are managing a containment procedure for an external C2 callback. Which firewall rule configuration is most effective for immediate containment?

A suspicious PowerShell script is found on an endpoint. Which tool would you use to perform volatile memory analysis to identify if the script injected malicious code?

During a suspected malware incident, a SOC analyst needs to isolate an infected workstation using Microsoft Defender for Endpoint. Which specific action should the analyst select within the Device inventory dashboard?

You are using an EDR to hunt for persistent scheduled tasks. Which artifact should you analyze to see tasks created within the last 24 hours?

What is the primary purpose of a 'War Room' during a major incident?

When dealing with a ransomware incident, why should you prioritize disconnecting the host from the network over immediate rebooting?

During an investigation, you need to perform a live acquisition of a suspect's system memory using FTK Imager. What is the correct order of operations to maintain integrity?

Which document should you reference first to determine the communication path during a high-severity security incident?

In the NIST Incident Response lifecycle, which phase involves the identification of the incident type and scope?

An analyst is reviewing logs in Splunk to investigate a potential exfiltration event. Which field should the analyst focus on to identify the volume of data sent to an external IP?

You are remediating a compromised web server. After identifying the web shell, what is the next step to prevent further access?

In the context of the MITRE ATT&CK framework, what is the primary goal of the 'Command and Control' tactic?

You are performing triage for an alert involving unauthorized access to an S3 bucket. Which service would you consult to review the API calls made to that bucket?

While analyzing an incident involving a malicious domain, you need to determine when the domain was registered. Which database should you query?

During a suspected lateral movement incident, you observe successful SMB sessions between two workstations. Which tool in Windows can be used to view these active sessions?

What is the primary function of an IOC (Indicator of Compromise) in an incident?

Which document is essential for recording every action taken during an incident for legal and audit purposes?

When an analyst suspects that a malicious user is using a VPN to hide their source IP, which technique is most helpful for attribution?

You are investigating a data exfiltration incident. Which protocol's logs would most likely show large volumes of data being moved to a cloud storage provider?

What is the primary goal of the 'Eradication' phase in incident response?

What is the main objective of the 'Post-Incident Activity' phase?

During a phishing investigation, you receive a suspicious link. Which safety measure should you use to analyze the link?

You need to verify if an executable is malicious. Which site is most effective for checking the hash against multiple antivirus engines?

During a suspected breach, you identify a rogue process running on a Linux server. Which command identifies the network socket associated with this process?

Which TWO steps are part of the 'Preparation' phase of the incident response process?

You notice an anomaly in your DNS traffic. Which type of DNS record is commonly associated with DNS tunneling for command and control?

A ticket is assigned to you with high priority. What is the first thing you should do?

Which TWO pieces of information are critical to include in an initial incident ticket?

Which TWO methods are commonly used to achieve persistence on a Windows host?

Which TWO types of logs are most useful for detecting lateral movement?

Which THREE factors should be considered when determining the severity level of an incident?

Which THREE items should be included in a standard incident containment report?

Which TWO items are part of the 'Lessons Learned' process?

Which THREE tools are typically used for forensic memory analysis?

Which THREE actions are appropriate during the eradication phase of a malware incident?

Which THREE factors contribute to 'dwell time' in a security incident?

Which THREE elements are essential in an incident notification email to senior management?

Which TWO indicators should an analyst watch for in a potential phishing campaign?

Which THREE actions are part of the 'Recovery' phase?

During an incident response engagement, a SOC analyst needs to acquire volatile memory from a running Windows 10 endpoint before isolating it from the network. The analyst must ensure the memory image is forensically sound and preserves the order of volatility. Which of the following should the analyst do FIRST?

A SOC analyst is responding to a confirmed ransomware incident on a file server. The analyst must preserve evidence for potential legal action while also containing the threat. Which TWO actions should the analyst perform to maintain forensic soundness during containment? (Choose two.)

During an incident involving a Windows workstation that exhibits beaconing to an external IP every 60 seconds, you need to preserve volatile evidence before the machine is rebooted. Which of the following should you capture FIRST according to order of volatility?

During an incident, a SOC analyst needs to preserve volatile memory on a Windows Server 2019 host before shutting it down. The server is running critical services and cannot be taken offline immediately. Which action best preserves the most volatile evidence while minimizing disruption?

A SOC analyst receives an alert that a domain controller is generating a high volume of Kerberos ticket-granting service (TGS) requests with RC4 encryption for various service principal names. The analyst suspects a Kerberoasting attack. Which Windows event ID should the analyst prioritize to confirm the attack?

A SOC analyst is investigating a suspected ransomware incident on a Windows 10 endpoint. The user reported a pop-up demanding payment, and files have been renamed with a .locked extension. The analyst has isolated the endpoint from the network. Which artifact should the analyst examine FIRST to identify the ransomware variant and potential decryption tools?

A SOC analyst receives an alert about a possible data exfiltration attempt from a database server. The analyst needs to determine if large amounts of data were transferred outbound. Which network monitoring approach would best provide this information?

A SOC analyst is investigating a suspected data exfiltration incident. Network logs show large outbound transfers to an unfamiliar IP address over HTTPS. The analyst wants to determine if the traffic is malicious command and control (C2) or legitimate business traffic. Which technique should the analyst use to inspect the encrypted payload without terminating the session?

A SOC analyst is reviewing a suspicious email reported by a user. The email contains a link to a seemingly legitimate website, but the analyst suspects a phishing attempt. Which action should the analyst take to safely analyze the URL without compromising the corporate network?

A SOC analyst is performing post-incident analysis after a successful containment of a malware outbreak. The analyst needs to identify which two Windows Registry locations are commonly used by malware for persistence to ensure they are cleaned. (Choose two.)

A SOC analyst is reviewing a packet capture from a suspected compromised host. The analyst observes a series of DNS queries for long, random-looking subdomains of a single domain, followed by TXT record responses containing encoded data. Which type of attack is most likely occurring?

A SOC analyst is preparing an incident response report for a confirmed phishing incident that led to credential theft. The analyst must document the timeline and impact. Which TWO artifacts should the analyst include to support the timeline and scope of the incident? (Choose two.)

A SOC analyst is following the organization's incident response plan and has just completed containment of a malware outbreak. According to the NIST SP 800-61 lifecycle, which phase should the analyst perform next?