ISC Security Operations — Timed 10 Questions

Question 1

An organization uses Microsoft Sentinel. To ensure that an automated incident response playbook only triggers when a high-severity alert originates from a specific production subnet, where should the condition be defined?

10 minute time limit — choose an answer to begin.

Accepted Answer

In the Automation Rule trigger condition. The logic app trigger conditions or the Sentinel Automation Rule 'If' conditions allow filtering based on alert properties like severity and entity fields.

Answer

In the Azure Policy definitions

Answer

In the Sentinel Data Connector configuration

Answer

Inside the KQL query of the analytic rule

Question 2

In an incident response plan, which metric is most useful for measuring the 'dwell time' of a threat actor?

Accepted Answer

Mean Time to Detect (MTTD). Dwell time is the period between the initial compromise and the time the organization detects the breach.

Answer

Mean Time to Acknowledge (MTTA)

Answer

Mean Time to Recovery (MTTR)

Answer

Mean Time to Contain (MTTC)

Question 3

Which document is considered the primary 'source of truth' for defining the SOC's roles, responsibilities, and communication paths during a major security incident?

Accepted Answer

Incident Response Plan (IRP). The Incident Response Plan (IRP) defines the strategy and governance for responding to incidents.

Answer

Vulnerability Assessment Report

Answer

Standard Operating Procedure (SOP)

Answer

Asset Inventory

Question 4

When using Palo Alto Networks Cortex XSOAR, which component is responsible for orchestrating the execution of scripts across multiple third-party integrations?

Accepted Answer

Playbook. The XSOAR 'Playbook' engine manages the logic flow and script execution across various integrated products.

Answer

Classifier

Answer

Integration Instance

Answer

Indicator Field

Question 5

An organization is investigating a potential lateral movement incident in AWS. Which CloudTrail event field provides the most reliable indicator of the source IP address for an API call performed by an IAM role?

Accepted Answer

sourceIPAddress. The 'sourceIPAddress' field in the CloudTrail log entry directly identifies the client IP that made the API request.

Answer

recipientAccountId

Answer

requestParameters

Answer

userIdentity.arn

Question 6

When configuring CrowdStrike Falcon to isolate a host during an active incident, what is the prerequisite requirement for the agent's communication state?

Accepted Answer

The agent must maintain an active connection to the Falcon Cloud. The Falcon agent must have an active heartbeat to the Falcon Cloud to receive the 'Isolate' command.

Answer

The agent must be in 'Aggressive' sensor mode

Answer

The host must have full disk encryption disabled

Answer

The host must be in a 'Managed' group with full administrative rights

Question 7

In Tenable.io, when prioritizing vulnerability remediation, which metric provides the best insight into the likelihood of a vulnerability being exploited in the wild?

Accepted Answer

Vulnerability Priority Rating (VPR). The Vulnerability Priority Rating (VPR) incorporates threat intelligence and exploit code availability, making it more accurate for risk-based prioritization than CVSS alone.

Answer

Plugin Family

Answer

Asset Criticality Rating

Answer

CVSS Base Score

Question 8

In Splunk Enterprise Security, which dashboard should the SOC manager review to evaluate the effectiveness of the current correlation searches and the volume of notable events?

Accepted Answer

Content Management Dashboard. The Content Management dashboard provides insights into the performance, trigger volume, and status of correlation searches.

Answer

Threat Intelligence Dashboard

Answer

Asset Center

Answer

Incident Review Dashboard

Question 9

When analyzing network traffic in Wireshark for potential exfiltration, what specific filter allows you to isolate TCP traffic where the payload size exceeds 10MB?

Accepted Answer

tcp.len > 10000000. While Wireshark does not have a single simple filter for payload size without complex length calculations, the correct syntax involves identifying TCP segments that contain payload.

Answer

frame.size > 10000000

Answer

ip.len > 10000000

Answer

tcp.payload.size > 10000000

Question 10

Which phase of the NIST Incident Response Life Cycle involves activities like system sanitization and validation of system integrity?

Accepted Answer

Containment, Eradication, and Recovery. Recovery includes restoring systems to normal operation and confirming they are secure.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Preparation