Incident Detection And Response

Which TWO of the following actions are considered best practices during the 'Containment' phase of an incident response workflow?

You are configuring a Splunk Enterprise Security (ES) Correlation Search to detect potential brute-force activity. You need to ensure the search generates a notable event only when the threshold of 10 failed logins occurs within a 5-minute window for a specific user. Which Correlation Search attribute should be modified?

You are using an ELK Stack (Elasticsearch, Logstash, Kibana) for incident response. You have identified a time-based spike in traffic. What is the most efficient way to query for the top 10 unique source IP addresses for a specific destination over the last hour using Kibana Discover?

You are investigating an EDR alert showing suspicious PowerShell execution. You need to identify the parent process that spawned the malicious script. Which tool or view would best allow you to visualize this process tree?

You are managing an incident where an adversary is utilizing a 'Living off the Land' (LotL) technique. Which log source is most critical to detect this activity?

During a Microsoft Sentinel incident investigation, you notice that a specific alert triggered by a custom analytic rule is creating too many false positives due to a noisy service account. You want to exclude this account without disabling the entire rule. What is the most effective approach?

When performing digital forensics on a volatile memory dump, which THREE artifacts should you prioritize to identify evidence of fileless malware?

When performing containment of a compromised endpoint in CrowdStrike Falcon, which feature should you use to prevent the adversary from using the machine to move laterally while still allowing incident responders to pull memory dumps?

You are configuring a Splunk Enterprise Security notable event action. Which setting ensures the notable event remains in the 'In Progress' state until a specific analyst manually updates the status?

You are investigating a suspected data exfiltration incident. You need to analyze network traffic captured in a PCAP file. Which tool is the industry standard for performing deep packet inspection and protocol analysis during this investigation?

During a triage process, you need to identify the process tree of a suspicious PowerShell execution on a Windows host using Sysmon. Which Event ID should you filter for?

While using Microsoft Sentinel, you observe that incidents are not triggering for brute force attempts despite a KQL rule being enabled. What is the most likely cause related to the 'Incident Settings' configuration?

In the context of the NIST Incident Response lifecycle, which phase involves the root cause analysis and the documentation of lessons learned?

When analyzing a memory dump using Volatility 3, which plugin is most effective for detecting code injection in a suspicious process?

A user reports they cannot access a shared drive following a suspected ransomware infection. What is the immediate containment action according to standard incident response best practices?

You are investigating a suspicious login in Okta. Which log field should be analyzed to determine if the session originated from an anonymized VPN or Tor exit node?

You are performing a digital forensic image of a SATA drive. Which tool is standard for creating a bit-stream image while ensuring data integrity via a hash verification?

A security analyst is triaging an alert about an unauthorized login from an unusual country. What is the first priority in the response workflow?

You are reviewing AWS CloudTrail logs to investigate an unauthorized modification of an S3 bucket policy. Which event name should you search for?

During an investigation, you discover a malicious cron job on a Linux server. Which directory is the primary location for user-specific cron tasks?

You are auditing a Linux server for persistence mechanisms. Which file is commonly used by attackers to hide malicious code that executes upon every user login?

A SIEM has triggered an alert for 'Excessive Failed Login Attempts' followed by a 'Successful Login'. Which technique is this most likely attempting to detect?

After an incident, you need to preserve the volatile memory of a compromised machine. What is the correct order of operations according to the Order of Volatility?

While investigating an incident in Google Workspace, you notice suspicious file sharing. Which log type should be queried to see which files were shared externally by a specific user?

You are investigating a PowerShell-based attack. The attacker is using Base64 encoded commands. Which command line switch often indicates the use of encoded code?

You are configuring a 'Watchlist' in Sentinel to detect when a specific list of known malicious IPs interact with your environment. What is the correct method to map this watchlist to an analytics rule?

Which type of log provides the most granular detail regarding local account creation on a Windows Server?

You are investigating a suspicious process on Windows. You see it is running from 'C:\ProgramData'. Which tool allows you to check if the process signature is valid?

A SIEM alert indicates a 'Golden Ticket' attack. What is the primary indicator of this attack in the logs?

When drafting an incident report, what is the most important element to include for the executive summary?

You are analyzing a PCAP file and see numerous 'ICMP Echo Request' packets with unusually large payloads. What is this likely indicative of?

In an Azure environment, you detect a malicious actor performing 'Pass-the-Token' attacks. Which sign-in log detail confirms this?

You are analyzing an endpoint and suspect a fileless malware attack. Which of the following is the most likely location for the malicious script to reside?

While investigating a web server breach, you find malicious PHP web shells. What is the most effective way to identify the source of the upload?

A phishing simulation resulted in a user clicking a link. What is the next logical step in the incident response process?

What is a 'False Positive' in the context of SIEM alerting?

You are investigating a potential credential harvesting site. Which tool is best suited to safely inspect the site without triggering a potential infection?

Which type of evidence is collected to prove that a specific individual was responsible for an action on a system?

In a Linux system, which tool is used to identify open network connections and the specific process ID (PID) associated with them?

What is the primary goal of the 'Eradication' phase in incident response?

During a forensic analysis, you find a suspicious file that was renamed to look like a system file. What is the most reliable way to identify its true nature?

You are investigating a potential insider threat. Which log is most useful for tracking file deletion activity on a Windows file server?

You are monitoring a network and detect a large number of ARP requests from a single host targeting the entire subnet. This is a sign of what?

Which TWO actions are required to properly secure a compromised user account during the eradication phase?

When a workstation is compromised, why is it recommended to isolate it rather than turning it off?

Which THREE of the following are common sources for SIEM data ingestion to assist in incident detection?

Which TWO tools are commonly used for memory forensic analysis?

Which THREE indicators should an analyst monitor to identify a potential web server compromise?

Which TWO of the following are essential components of an effective Incident Response Plan (IRP)?

Which THREE types of data are typically found in a full forensic disk image?

Which TWO documents are essential to provide to a forensic investigator?

Which THREE behaviors are characteristic of a potential data exfiltration attempt?

Which TWO of the following are true regarding the use of hashing in digital forensics?

Which THREE types of network logs are most effective for identifying a data breach?

Which THREE techniques do attackers use to maintain persistence on a Windows host?

Which TWO actions should be taken if an incident is confirmed to involve sensitive PII?

Which THREE factors should be considered when assessing the severity of a security incident?

Which THREE steps are part of the 'Preparation' phase of incident response?

Which TWO sources are used to populate threat intelligence feeds for incident detection?

When classifying a security incident using the NIST SP 800-61 framework, which phase is focused on identifying the precursors and indicators of an attack?

A security analyst is investigating a suspected beaconing behavior in network traffic logs. The traffic consistently shows small, periodic connections to an external IP. Which statistical analysis method is most effective for identifying this pattern within high-volume PCAP or NetFlow data?

During an incident response engagement involving a ransomware attack, the team decides to isolate the affected endpoint using an EDR solution. What is the expected behavior of the EDR tool during the 'network isolation' process?

A CISO asks for a list of indicators that should be monitored in the SIEM to detect potential account takeover attempts. Which THREE indicators are most relevant?

Which of the following activities is best categorized as an 'eradication' step in the incident response lifecycle?

When conducting digital forensics on a volatile memory dump using the Volatility Framework, which TWO plugins would be most effective in identifying malicious kernel-mode rootkits?

A security analyst is reviewing a packet capture of an internal host that appears to be communicating with an external server. The analyst observes that the TCP three-way handshake completes successfully, but the session then becomes idle for approximately 30 seconds before a small application-layer message is sent. This pattern repeats consistently. Which type of malicious activity is most consistent with this behavior?

A CCOA analyst is reviewing a suspected credential-stuffing incident against the organization's customer portal. The web server logs show thousands of POST requests to /login with varying usernames but originating from a rotating set of source IPs. The analyst needs to determine whether the activity is a distributed brute-force attack or normal user behavior. Which data source would BEST provide the authoritative evidence of failed authentication attempts across all application instances?

A security operations center (SOC) analyst is triaging a potential endpoint compromise. The EDR console shows a suspicious process created by a Microsoft Word document that spawned a child process of 'powershell.exe' with the arguments '-nop -w hidden -enc JABjAGwAaQBlAG4AdA...'. The parent process has since exited. Which detection technique would best confirm whether this activity represents a true positive?

During an incident investigation, an analyst discovers that an attacker used a compromised service account to move laterally across multiple systems. The analyst needs to determine the extent of the compromise by identifying all systems where the account was used to authenticate. Which data source would be most effective for this purpose?

During a suspected data exfiltration incident, a CCOA analyst observes that a workstation is sending DNS queries for subdomains such as 'a1b2c3d4e5.exfil.example.com'. The queries are small and occur at irregular intervals. The analyst wants to confirm DNS tunneling rather than normal DNS resolution. Which characteristic of the DNS traffic would MOST reliably indicate tunneling?

A healthcare organization's incident response team is investigating a breach involving a compromised web server that may have exposed patient data. The team must determine the scope of the data exposure. Which of the following actions should be performed FIRST to preserve evidence while enabling analysis?

A security operations center (SOC) analyst is triaging an alert indicating a potential phishing email that was delivered to several users. The analyst needs to determine if any user interacted with the malicious link. Which two data sources would be most directly useful for this determination? (Choose two.)

A CCOA analyst is triaging an alert from the SIEM indicating that a user account was added to the Domain Admins group outside of a change window. The analyst needs to determine whether this is a malicious privilege escalation or an authorized administrative action. Which immediate step BEST supports this determination?

A security operations center (SOC) analyst receives an alert from the SIEM indicating that a domain controller has generated a high volume of Kerberos ticket-granting service (TGS) requests using RC4 encryption, with service principal names (SPNs) that do not exist. The analyst suspects a Kerberoasting attack. Which artifact should the analyst collect first to confirm the attack and identify the targeted service accounts?

A security analyst notices that a user's workstation is repeatedly connecting to an external IP address every 60 seconds, sending small amounts of data. The traffic pattern is consistent and occurs even when the user is not actively working. Which type of malware behavior is most likely indicated?

A CCOA analyst is responding to an incident involving a compromised web server that is part of a load-balanced cluster. The analyst needs to preserve volatile evidence before the server is rebooted for remediation. Which TWO actions should the analyst perform to capture volatile data? (Choose two.)

An analyst is reviewing a security incident and needs to determine the order of events. The analyst has collected logs from various sources with different timestamp formats and time zones. Which action should the analyst take first to ensure an accurate timeline?

A CCOA analyst receives an alert that the account 'svc_backup' performed an interactive logon (Type 2) to a domain controller at 02:17. The account is normally used only for scheduled backup jobs. The analyst needs to determine whether this is a credential misuse incident. Which Windows event should the analyst examine first to confirm the logon type and source workstation?

A healthcare organization's incident response team is handling a breach involving protected health information (PHI). The legal team requests that the incident responders preserve evidence in a manner that maintains its admissibility in court. The responders have already created a forensic image of the affected server's disk. Which of the following is the MOST critical step to ensure the evidence remains admissible?

A security analyst is investigating a suspected data breach and needs to determine if sensitive data was exfiltrated. The analyst has access to full packet capture (PCAP) data from the network perimeter. Which technique would be most effective for identifying large outbound data transfers?

During incident response for a suspected data exfiltration, the team captures full packet data at the perimeter. The CCOA analyst needs to determine whether large outbound transfers occurred over an encrypted channel that cannot be inspected. Which network flow artifact should the analyst use to identify the volume and duration of the transfers while preserving the ability to correlate with other logs?

A financial institution's SOC is investigating a suspected data exfiltration incident. The team has collected network flow data, proxy logs, and endpoint logs. Which two of the following indicators are MOST indicative of data exfiltration over a covert channel? (Choose two.)

A CCOA analyst is triaging an alert about a workstation that repeatedly contacts a known malicious IP address. The analyst wants to quickly block further communication from that host while preserving volatile evidence for later analysis. Which action best meets both goals?

A security analyst is reviewing the Incident Response Plan (IRP) and notices that it lacks a defined communication protocol for notifying external stakeholders during a breach. Which phase of the incident response lifecycle does this gap primarily affect?

A security analyst is investigating a suspected insider threat. The analyst has collected volatile data from a suspect's workstation, including running processes, network connections, and logged-in users. Which of the following should the analyst do NEXT to maintain the integrity of the evidence for potential legal proceedings?

A CCOA analyst is investigating a suspected insider threat involving unauthorized access to a file server. The analyst needs to correlate user activity with file access events. Which two log sources should the analyst prioritize? (Choose two.)

A threat hunter is analyzing endpoint telemetry and notices a process that has established a network connection to an external IP address. The process is running from a temporary directory, has no digital signature, and its parent process is a known vulnerable service. Which of the following techniques is MOST consistent with this behavior?

A CCOA analyst is leading the lessons learned review after a major incident. The team wants to improve future detection and response. Which output of the lessons learned phase is most directly used to update detection capabilities?

A CCOA analyst is investigating a malware incident on a Windows 10 endpoint. The analyst needs to determine the persistence mechanism used by the malware to survive reboots. Which Windows artifact should the analyst examine first to identify programs configured to run automatically at user logon?

A CCOA analyst is triaging an alert from the SIEM indicating a potential malware outbreak on a Windows server. The analyst wants to quickly identify the parent process of a suspicious child process using Sysmon telemetry. Which Sysmon event field should the analyst focus on to establish the process lineage?

A CCOA analyst is examining a Linux server suspected of compromise. The analyst runs 'netstat -tulpn' and observes an unknown process listening on TCP port 4444. To identify the executable associated with this process, which command should the analyst use next?

A CCOA analyst is preparing to acquire volatile data from a compromised Windows system before shutting it down. Which two types of data should be collected first because they will be lost upon shutdown? (Choose two.)

A CCOA analyst receives an alert about a suspicious email attachment that was opened by a user. The analyst wants to determine if the attachment executed and established persistence. Which Windows artifact would provide the most direct evidence of the executable's file path and creation time?

A CCOA analyst receives an alert about a possible phishing email that bypassed the secure email gateway. The analyst needs to extract and analyze the email headers to determine the true sender. Which email header field should the analyst examine to find the originating IP address of the sender?

A CCOA analyst is reviewing a suspected data exfiltration incident. The analyst needs to identify the command and control (C2) channel used by malware. Which network artifact would best reveal the domain names and IP addresses contacted by the malware?

A CCOA analyst is responding to an incident involving a compromised Linux server. The analyst needs to collect volatile data for forensic analysis. Which two commands should the analyst use to capture running processes and network connections? (Choose two.)

A CCOA analyst is reviewing network traffic logs and notices a series of DNS queries for randomly generated domain names that are subdomains of a single domain. The queries are frequent and the responses are often NXDOMAIN. Which technique should the analyst suspect?