A SOC analyst observes excessive traffic on port 443 originating from an internal server to an unknown external IP. Which command should the analyst run on a Linux-based server to identify the specific process ID (PID) associated with this connection?
A cloud-based application is suffering from slow database queries. You suspect a misconfigured connection pool. Which log type in the cloud provider's console should you examine first?
You are managing a Linux server that has become unresponsive. You suspect a 'fork bomb'. How can you limit the number of processes a user can run to prevent this?
A security analyst at a financial firm is reviewing a suspicious email that appears to come from a known vendor. The email contains a link to an external site that prompts the user to enter credentials. The analyst suspects a phishing attack. Which of the following should the analyst examine FIRST to determine the legitimacy of the email?
A security analyst is reviewing network traffic and observes a high volume of DNS queries for randomly generated subdomains of a single domain, such as 'a1b2c3.example.com', 'd4e5f6.example.com'. The queries are of type TXT and the responses contain long strings of encoded data. Which technique is most likely being used?
A security analyst is examining a Linux server that is suspected of being compromised. The analyst runs `ss -tulpn` and observes an unfamiliar process listening on TCP port 4444. To identify the process executable and its command line, which command should the analyst use next?
A security analyst is implementing TLS for a new web application. The analyst must select cipher suites that provide forward secrecy and strong encryption. Which two of the following cipher suites meet these requirements? (Choose two.)
A CCOA analyst is reviewing a capture from a mirrored switch port and needs to confirm whether a suspicious outbound session used TLS 1.3 with a valid server certificate chain. The analyst must determine the negotiated protocol version and the issuer of the leaf certificate without altering the traffic. Which Wireshark capability should the analyst rely on?
A security analyst is examining a memory dump from a compromised Windows system. The analyst wants to identify injected code or reflective DLL loading that may not be visible in the process list. Which Volatility 3 plugin should the analyst use to detect hidden or unlinked processes and injected code?
A CCOA analyst is investigating a suspected malware infection on a Windows 10 endpoint. The analyst wants to examine the list of processes that are configured to start automatically at system boot, including those in the Run registry keys and Startup folders. Which built-in Windows tool should the analyst use to view and manage these startup items?
A CCOA analyst is configuring a Snort IDS to detect a specific type of attack. The analyst wants to create a rule that alerts when an inbound TCP packet to the web server on port 80 contains the string 'cmd.exe' in the payload, and the packet is from any external IP. Which two Snort rule header components are required to match this traffic? (Choose two.)
When analyzing a virtual machine's security, you note it is using a 'Bridged' network adapter. What is the primary security implication of this configuration?
You need to identify unauthorized modifications to system binaries on a Red Hat Enterprise Linux server. Which tool is best suited for this integrity verification?
You are troubleshooting a Windows Server service that refuses to start due to a permission issue. Which tool allows you to audit the effective permissions of the service account against the executable file?
In a cloud environment, you are configuring a Security Group for an EC2 instance. To allow only incoming web traffic over HTTPS from a specific subnet, which configuration is most secure?
You are monitoring an AWS environment. A specific IAM role has suddenly started performing anomalous API calls. Which service should you review to see the history of these calls?
You are auditing a web application server. You discover it is running with high privileges. What is the standard security practice to mitigate this risk?
A SOC analyst is investigating suspicious outbound traffic from an internal host to a known command-and-control server. The analyst needs to capture full packet payloads for deep inspection and later forensic analysis. Which tool should the analyst use to capture the traffic on the Linux-based sensor?
A security analyst is examining a Windows event log and notices Event ID 4625 followed by Event ID 4624 with Logon Type 3 from the same source IP within a few seconds. The account used is a local administrator. What is the most likely explanation for this sequence?
A SOC analyst is investigating a suspected data exfiltration event on a Windows 10 endpoint. The analyst needs to enumerate all active network connections along with the owning process IDs to identify which process is communicating with an external IP. Which built-in Windows command should the analyst use?
A company is deploying a new web application in a public cloud. The security team must ensure that the application's data at rest is encrypted and that the encryption keys are managed by the cloud provider while still allowing the company to control key rotation. Which cloud key management service should they use?
A network engineer is designing a demilitarized zone (DMZ) for a company's public-facing web servers. The requirement is to ensure that if a web server is compromised, the attacker cannot directly reach internal database servers. Which control best achieves this segmentation?
A security analyst is investigating a suspected breach and needs to determine whether an attacker moved laterally within the network. The analyst has access to NetFlow records from core switches. Which analysis technique is most effective for identifying lateral movement?
A SOC analyst is investigating a potential data exfiltration incident. Network logs show a large volume of outbound traffic from an internal server to an external IP address over port 53. The analyst suspects DNS tunneling. Which of the following techniques would BEST confirm this suspicion?
A security administrator is configuring a Linux web server to run as a non-privileged user. The server needs to bind to TCP port 80. Which capability should be assigned to the web server binary to allow binding to a privileged port without running as root?
An analyst at a financial firm is reviewing network flow logs and notices a workstation repeatedly initiating SMB connections to multiple internal servers on TCP port 445, followed by large outbound data transfers to an external IP. The workstation's user reports no unusual activity. The analyst suspects lateral movement and data exfiltration. Which technology should the analyst use to correlate these network events with endpoint process and file activity to confirm the attack chain?
A security operations center (SOC) is implementing a new SIEM and needs to ensure that log data from various sources is normalized for effective correlation. Which TWO of the following are key considerations when normalizing log data? (Choose two.)
A security operations center (SOC) analyst is reviewing logs from a Windows server and notices Event ID 4625 (An account failed to log on) occurring repeatedly for the same user account from a single source IP within a short time frame. Which type of attack does this pattern most likely indicate?
A security analyst is reviewing firewall logs and sees that an internal web server is making DNS queries to an external IP address that is not a known DNS resolver. The queries are for random-looking subdomains of a domain with no reputation. The volume of queries is high and consistent. The analyst suspects DNS tunneling for command and control. Which technology would best detect this activity by analyzing DNS query patterns and payload characteristics?
A security operations center (SOC) is implementing network segmentation to protect critical assets. Which TWO of the following are essential components of a secure segmented network design? (Choose two.)
A security operations center is reviewing its endpoint detection and response (EDR) coverage. The team wants to ensure that the EDR solution can detect and respond to threats that use fileless techniques and living-off-the-land binaries (LOLBins). Which two capabilities are most critical for the EDR to provide this coverage? (Choose two.)
A company is deploying a new web application and wants to ensure that it is protected against SQL injection attacks. The application uses a backend database. Which of the following is the MOST effective mitigation to prevent SQL injection?
A security operations center (SOC) analyst is investigating a suspected breach. The attacker used PowerShell to download and execute a payload in memory, leaving minimal disk artifacts. The analyst needs to reconstruct the attack by examining Windows event logs. Which Windows event log source should the analyst prioritize to find PowerShell script block logging and module logging details?
A security analyst is reviewing firewall logs and notices a large number of outbound connection attempts to various external IP addresses on port 445. The analyst suspects a compromised host is attempting to spread laterally or exfiltrate data. Which protocol is associated with port 445, and what is the primary security concern?
A security analyst is examining a suspicious PowerShell script that was executed on a Windows endpoint. The script appears to download and execute a payload from a remote server. Which of the following PowerShell features is MOST likely being abused to obfuscate the malicious code?
A company is migrating its on-premises workloads to a hybrid cloud environment. The security team must ensure that data stored in the cloud object storage service is encrypted at rest and that the encryption keys are managed by the organization, not the cloud provider. The team also needs the ability to revoke access to the keys immediately if a compromise is suspected. Which key management approach should the team implement?
A SOC analyst is reviewing a suspicious email reported by a user. The email contains a link to a domain that was registered two days ago. The analyst needs to perform dynamic analysis of the URL to determine if it leads to a malicious payload. Which two actions should the analyst take to safely analyze the URL and gather threat intelligence? (Choose two.)
During an investigation, a CCOA analyst observes that a Linux web server's /var/log/auth.log shows repeated successful sudo commands by the www-data account, which should never have interactive privileges. The analyst must preserve volatile evidence before remediation. Which action best follows accepted order of volatility while enabling later forensic reconstruction?
A CCOA analyst is hardening a Kubernetes cluster and wants to prevent any container from running with root privileges or escalating to root inside the pod. Which Kubernetes security control directly enforces this at admission time?
A CCOA analyst is evaluating a zero trust architecture for a hybrid environment. The organization wants to ensure that every access request is authenticated and authorized based on multiple signals before a session is established. Which core zero trust principle does this requirement embody?
A CCOA analyst is reviewing a memory image from a compromised Windows host. The analyst needs to identify evidence of process injection and persistence that may not appear in the file system. Which two artifacts should the analyst prioritize examining? (Choose two.)
A CCOA analyst is reviewing authentication logs for a Windows environment. The analyst observes a large number of successful logons using NTLMv2 for internal file share access, even though the domain is at a functional level that supports Kerberos. The analyst suspects that some clients are not using Kerberos due to misconfiguration. Which Windows command-line tool should the analyst use to verify the effective authentication protocol being used for a specific server?
A security operations analyst is reviewing a packet capture and notices a large volume of TCP SYN packets sent to many different destination ports on a single internal host, with no corresponding SYN-ACK responses. The analyst wants to determine the intent of this traffic. Which type of activity does this pattern most likely represent?
A CCOA analyst is documenting the controls used to protect data at rest on a database server. The organization requires that stored data remain unreadable even if the physical disk is stolen. Which technology directly satisfies this requirement?
A CCOA analyst is examining a Linux server that is suspected of being compromised. The analyst runs the command 'netstat -tulnp' and sees an unfamiliar process listening on TCP port 4444. To identify the executable path associated with this process, which command should the analyst use next?
An analyst is reviewing authentication logs and sees repeated successful logons for a service account from several geographically distant locations within a short time window. The service account is configured with a long random password and is used by a scheduled backup job. Which explanation is most consistent with this pattern?
A security analyst is configuring a web application firewall to protect an e-commerce site from injection attacks. The analyst wants to block requests that contain suspicious SQL syntax in input fields while minimizing false positives on legitimate product searches. Which approach best meets this goal?
A CCOA analyst is reviewing the security posture of an organization's public cloud tenancy. The team wants to reduce the risk of credential-based attacks against the cloud management plane. Which two measures most directly strengthen identity protection for administrative access? (Choose two.)
A CCOA analyst is investigating a suspected data exfiltration incident. The analyst has captured network traffic and wants to reconstruct files that were transferred over HTTP. Which tool should the analyst use to extract files from the packet capture?