In Splunk Enterprise Security, you are investigating a high-fidelity alert generated by the 'Access - Successful Web Authentication - Previous Success' correlation search. You notice the notable event is missing the user's location metadata. What is the most appropriate step to enrich this data for future triage?
You are configuring a correlation rule in IBM QRadar to detect brute-force attacks. You need to ensure that the rule only triggers when a user fails to authenticate five times within a 60-second window across any three distinct source IP addresses. Which building block or configuration approach is most efficient?
A SOC analyst is triaging a SIEM alert for a potential malware infection on a critical server. The alert was triggered by a signature detecting the presence of a known malware hash. The analyst checks the file and finds that it is a legitimate administrative tool that was recently updated. The hash matches because the malware author copied the tool and added malicious code. The analyst needs to determine if the server is actually infected. Which of the following is the MOST reliable method to confirm the infection?
You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?
In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?
You are reviewing a SIEM alert for a 'Brute Force Attack'. You notice the source IP is from a cloud provider. How should you classify this during triage?
An analyst is investigating an alert regarding an outbound connection to a known malicious IP. Which step should be taken first according to standard triage procedures?
In IBM QRadar, you notice that a specific log source is not contributing to offense creation. Upon checking the 'Log Activity' tab, you see events are being parsed but are not mapped to any QID. What is the next logical step?
You are configuring a correlation rule in Splunk Enterprise Security. An analyst reports that too many false positives are triggered for 'Multiple Failed Login Attempts'. What is the most effective way to tune this rule?
You are investigating a SIEM alert in Splunk that indicates a potential data exfiltration. The alert uses a threshold of 500MB. How can you improve the accuracy of this alert?
You are using a SIEM and notice that logs from a critical Windows server are missing. You verify the agent is running and the network is clear. What is the next step?
You suspect an attacker is using a specific user account to log in from multiple geographic locations simultaneously. Which SIEM capability allows you to detect this?
A SOC analyst is reviewing alerts in Microsoft Sentinel. They want to filter the 'SecurityAlert' table to only show alerts with a 'High' severity that originated from a specific resource provider. Which KQL operator should be used?
You are managing a SIEM and notice a massive spike in 'false positive' alerts originating from a legacy vulnerability scanner. What is the best practice for tuning these alerts without losing visibility into the scanner's activity?
You are designing a correlation rule in an ArcSight ESM environment. You need to aggregate events based on a 'SessionID' field, but the 'SessionID' is not explicitly parsed in the incoming CEF logs. What must you do first?
A SOC analyst is tasked with reducing 'alert fatigue' by categorizing alerts based on their MITRE ATT&CK technique mapping. Which phase of the incident response lifecycle is the analyst performing?
You are performing alert triage on a potential data exfiltration attempt. The SIEM shows 50GB of data transferred to a known cloud storage IP address. What is the most important next step in your triage process?
A SOC analyst receives an alert for suspicious PowerShell execution on a workstation. During triage, the analyst observes the command line: `powershell.exe -nop -w hidden -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAA...`. The endpoint's EDR shows the parent process as `winword.exe`. Which of the following BEST describes the immediate triage priority?
A SOC analyst is triaging an alert from a Windows server indicating a new service was installed. The service binary is located in `C:\Windows\Temp\svc.exe` and runs as `LocalSystem`. The analyst checks the service creation time and sees it was created 10 minutes ago. The server's change management system shows no approved changes. Which of the following is the MOST likely explanation?
A SOC analyst is triaging a potential phishing incident. An employee reported a suspicious email with an attachment. The analyst has retrieved the email and attachment. Which TWO of the following actions are MOST appropriate during the initial triage to determine if the attachment is malicious? (Choose two.)
A SOC analyst receives a Microsoft Defender for Endpoint alert indicating a suspicious PowerShell script executed on a finance workstation. The script attempted to download a file from an external IP. The alert severity is 'High'. According to the incident detection and triage process, what should the analyst do FIRST?
A SOC analyst is triaging a SIEM alert for a potential data exfiltration attempt. The alert shows a large outbound transfer to an unknown IP address from a database server. The analyst needs to determine if this is malicious or benign. Which of the following actions is MOST appropriate to perform FIRST?
A SOC analyst is triaging a phishing alert reported by a user. The email contains a link to a credential harvesting page. The analyst needs to determine the scope of the incident. Which TWO actions should the analyst perform to identify other users who may have received the same email? (Choose two.)
A SOC analyst receives an alert that a workstation's host-based sensor detected the process 'powershell.exe' spawning 'cmd.exe' which then spawned 'vssadmin.exe delete shadows /all /quiet'. The endpoint is still online and the user is actively logged in. According to the SOC incident handling process, what is the MOST appropriate next action?
A SOC analyst is investigating a potential insider threat. The SIEM generated an alert for unusual file access on a file server by a user who normally works in a different department. The analyst needs to gather more context. Which of the following is the MOST appropriate action to take?
A SOC analyst receives an alert from the SIEM indicating a potential brute-force attack against a domain controller. The alert shows 20 failed logon attempts (Event ID 4625) for the user 'administrator' within 30 seconds, followed by a successful logon (Event ID 4624) from the same source IP. The analyst wants to determine if this is a true positive and prioritize the response. According to incident triage best practices, what is the MOST appropriate next step?
During triage of a SIEM alert indicating multiple failed VPN authentications followed by a successful login for the same account within five minutes, the analyst must classify the event. Which classification is MOST appropriate at this stage?
A SOC analyst is triaging an alert from an endpoint detection and response (EDR) platform showing that 'rundll32.exe' loaded a DLL from the user's Downloads folder and then established an outbound connection to an unfamiliar IP on port 443. Which TWO actions should the analyst take FIRST to properly triage this alert? (Choose two.)
A SOC analyst is triaging a security alert generated by the SIEM. The alert indicates that a workstation attempted to connect to a known malicious IP address on port 443. The analyst verifies that the workstation's user recently received a phishing email. Which of the following should the analyst do FIRST to contain the potential incident?
A SOC analyst notices a spike in alerts for the same Windows event ID 4625 (failed logon) across dozens of workstations, each showing a different username and originating from the same internal server. The server is not a domain controller and has no legitimate authentication role. What does this pattern MOST likely indicate?
A SOC analyst is triaging a SIEM alert for a possible data exfiltration. The alert triggered because a large volume of data (5 GB) was transferred from an internal database server to an external IP address over the past hour. The analyst checks the database server's logs and sees that the transfer was initiated by a scheduled backup job that normally runs at 2 AM, but it is currently 10 AM. The backup job uses a service account that has access to the database. Which of the following is the MOST likely explanation for this alert?
A SOC analyst is reviewing a phishing alert where the user reported an email with a malicious attachment. The analyst confirms the attachment's hash matches a known malware family in the threat intelligence platform. The user states they did not open the attachment. What is the MOST appropriate triage outcome?
A SOC analyst is triaging a SIEM alert for a possible insider threat. The alert indicates that a user accessed a file share containing sensitive financial data outside of normal business hours. The analyst needs to gather additional context to determine if this is malicious. Which TWO of the following actions should the analyst perform to enrich the alert? (Choose two.)
A SOC analyst receives a QRadar offense titled 'Multiple Failed Logins Followed by Success' for a domain service account. The offense lists 42 events from a single source IP over 3 minutes. Before escalating, the analyst must perform initial triage. Which action best represents the first step of triage for this offense?
A SOC analyst is triaging a Microsoft Defender for Endpoint alert on a workstation. The alert shows 'lsass.exe' was accessed by an unsigned process named 'rundll32.exe' launched from a user's temp folder. The analyst needs to determine the appropriate triage priority. Which factor should most strongly influence the priority of this alert?
A SOC analyst in a Splunk ES environment is triaging a notable event for a possible phishing campaign. The notable event aggregates multiple email security alerts and endpoint alerts. The analyst must determine which additional data sources to correlate to confirm and scope the incident. (Choose two.)
A SOC analyst is triaging an alert from a network detection system indicating a possible internal port scan. The scan originated from a workstation and targeted multiple servers on TCP port 445. Before escalating, the analyst needs to determine whether this is malicious or benign. Which action provides the most relevant context for this decision?