In an IR scenario involving a compromised Microsoft 365 account, which command in the Security & Compliance PowerShell module is used to force sign-out of all active sessions?
You need to export a PCAP for a suspicious network flow. Using Wireshark, which filter would you use to isolate traffic from a specific suspicious source IP 192.168.1.50?
You are analyzing an alert for a suspicious PowerShell command. Which logging setting must be enabled on Windows endpoints to capture the full command-line arguments?
You are investigating a suspicious login. Which attribute in the Azure AD sign-in logs helps determine if the user successfully authenticated using MFA?
A SOC analyst receives an alert about a suspicious process on a Windows workstation. The analyst suspects the process is malicious and wants to quickly identify its parent process and command line to understand how it was launched. Which built-in Windows tool should the analyst use to obtain this information in real time?
After containing a ransomware outbreak on a file server, the incident response team needs to determine the initial infection vector. Which artifact would BEST help identify the original dropper file?
During an incident investigation, a SOC analyst discovers that an attacker used PsExec to move laterally from a compromised workstation to a server. The analyst wants to determine the source of the PsExec execution and the account used. Which Windows artifact should the analyst examine first to identify the user account that initiated the remote service creation?
A SOC analyst is responding to an incident where a user's workstation is infected with malware that beacons to a command-and-control (C2) server. The analyst has isolated the workstation from the network. Which two actions should the analyst take next to contain the incident and prevent further spread? (Choose two.)
A SOC analyst is investigating a suspected data exfiltration incident involving a compromised user account. The analyst has access to proxy logs, DNS logs, and NetFlow data. Which TWO data sources would BEST help identify the exfiltration channel and destination? (Choose two.)
A SOC analyst receives an alert about a possible ransomware infection on a file server. The analyst needs to contain the incident to prevent further encryption. Which action should the analyst take FIRST according to incident response best practices?
A SOC analyst is performing live response on a compromised Linux server. The analyst needs to capture the current network connections and associated processes. Which command should the analyst use?
A SOC analyst notices that the SIEM has not received any Windows event logs from a critical domain controller for the past six hours. Other servers are reporting normally. The analyst suspects the Windows Event Forwarding subscription has failed. Which Windows component should the analyst check first to verify the WEF subscription status on the domain controller?
During incident response, a SOC analyst needs to preserve volatile evidence from a compromised Windows workstation before containment. The analyst must capture the current network connections and the running processes with their command lines. Which built-in Windows tool should the analyst use to capture this information in a forensically sound manner before powering off?
A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?
While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?
You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?
A suspicious PowerShell script is found on an endpoint. Which tool would you use to perform volatile memory analysis to identify if the script injected malicious code?
During a suspected malware incident, a SOC analyst needs to isolate an infected workstation using Microsoft Defender for Endpoint. Which specific action should the analyst select within the Device inventory dashboard?
During an investigation, you need to perform a live acquisition of a suspect's system memory using FTK Imager. What is the correct order of operations to maintain integrity?
An analyst is reviewing logs in Splunk to investigate a potential exfiltration event. Which field should the analyst focus on to identify the volume of data sent to an external IP?
You are performing triage for an alert involving unauthorized access to an S3 bucket. Which service would you consult to review the API calls made to that bucket?
During a suspected lateral movement incident, you observe successful SMB sessions between two workstations. Which tool in Windows can be used to view these active sessions?
You are investigating a data exfiltration incident. Which protocol's logs would most likely show large volumes of data being moved to a cloud storage provider?
During a suspected breach, you identify a rogue process running on a Linux server. Which command identifies the network socket associated with this process?
During an incident response engagement, a SOC analyst needs to acquire volatile memory from a running Windows 10 endpoint before isolating it from the network. The analyst must ensure the memory image is forensically sound and preserves the order of volatility. Which of the following should the analyst do FIRST?
A SOC analyst is responding to a confirmed ransomware incident on a file server. The analyst must preserve evidence for potential legal action while also containing the threat. Which TWO actions should the analyst perform to maintain forensic soundness during containment? (Choose two.)
During an incident involving a Windows workstation that exhibits beaconing to an external IP every 60 seconds, you need to preserve volatile evidence before the machine is rebooted. Which of the following should you capture FIRST according to order of volatility?
During an incident, a SOC analyst needs to preserve volatile memory on a Windows Server 2019 host before shutting it down. The server is running critical services and cannot be taken offline immediately. Which action best preserves the most volatile evidence while minimizing disruption?
A SOC analyst receives an alert that a domain controller is generating a high volume of Kerberos ticket-granting service (TGS) requests with RC4 encryption for various service principal names. The analyst suspects a Kerberoasting attack. Which Windows event ID should the analyst prioritize to confirm the attack?
A SOC analyst is investigating a suspected ransomware incident on a Windows 10 endpoint. The user reported a pop-up demanding payment, and files have been renamed with a .locked extension. The analyst has isolated the endpoint from the network. Which artifact should the analyst examine FIRST to identify the ransomware variant and potential decryption tools?
A SOC analyst receives an alert about a possible data exfiltration attempt from a database server. The analyst needs to determine if large amounts of data were transferred outbound. Which network monitoring approach would best provide this information?
A SOC analyst is investigating a suspected data exfiltration incident. Network logs show large outbound transfers to an unfamiliar IP address over HTTPS. The analyst wants to determine if the traffic is malicious command and control (C2) or legitimate business traffic. Which technique should the analyst use to inspect the encrypted payload without terminating the session?
A SOC analyst is reviewing a suspicious email reported by a user. The email contains a link to a seemingly legitimate website, but the analyst suspects a phishing attempt. Which action should the analyst take to safely analyze the URL without compromising the corporate network?
A SOC analyst is performing post-incident analysis after a successful containment of a malware outbreak. The analyst needs to identify which two Windows Registry locations are commonly used by malware for persistence to ensure they are cleaned. (Choose two.)
A SOC analyst is reviewing a packet capture from a suspected compromised host. The analyst observes a series of DNS queries for long, random-looking subdomains of a single domain, followed by TXT record responses containing encoded data. Which type of attack is most likely occurring?
A SOC analyst is preparing an incident response report for a confirmed phishing incident that led to credential theft. The analyst must document the timeline and impact. Which TWO artifacts should the analyst include to support the timeline and scope of the incident? (Choose two.)
A SOC analyst is following the organization's incident response plan and has just completed containment of a malware outbreak. According to the NIST SP 800-61 lifecycle, which phase should the analyst perform next?