ISC Security Operations — Timed 20 Questions

Question 1

An organization uses Microsoft Sentinel. To ensure that an automated incident response playbook only triggers when a high-severity alert originates from a specific production subnet, where should the condition be defined?

20 minute time limit — choose an answer to begin.

Accepted Answer

In the Automation Rule trigger condition. The logic app trigger conditions or the Sentinel Automation Rule 'If' conditions allow filtering based on alert properties like severity and entity fields.

Answer

In the Azure Policy definitions

Answer

In the Sentinel Data Connector configuration

Answer

Inside the KQL query of the analytic rule

Question 2

In an incident response plan, which metric is most useful for measuring the 'dwell time' of a threat actor?

Accepted Answer

Mean Time to Detect (MTTD). Dwell time is the period between the initial compromise and the time the organization detects the breach.

Answer

Mean Time to Acknowledge (MTTA)

Answer

Mean Time to Recovery (MTTR)

Answer

Mean Time to Contain (MTTC)

Question 3

Which document is considered the primary 'source of truth' for defining the SOC's roles, responsibilities, and communication paths during a major security incident?

Accepted Answer

Incident Response Plan (IRP). The Incident Response Plan (IRP) defines the strategy and governance for responding to incidents.

Answer

Vulnerability Assessment Report

Answer

Standard Operating Procedure (SOP)

Answer

Asset Inventory

Question 4

When using Palo Alto Networks Cortex XSOAR, which component is responsible for orchestrating the execution of scripts across multiple third-party integrations?

Accepted Answer

Playbook. The XSOAR 'Playbook' engine manages the logic flow and script execution across various integrated products.

Answer

Classifier

Answer

Integration Instance

Answer

Indicator Field

Question 5

An organization is investigating a potential lateral movement incident in AWS. Which CloudTrail event field provides the most reliable indicator of the source IP address for an API call performed by an IAM role?

Accepted Answer

sourceIPAddress. The 'sourceIPAddress' field in the CloudTrail log entry directly identifies the client IP that made the API request.

Answer

recipientAccountId

Answer

requestParameters

Answer

userIdentity.arn

Question 6

When configuring CrowdStrike Falcon to isolate a host during an active incident, what is the prerequisite requirement for the agent's communication state?

Accepted Answer

The agent must maintain an active connection to the Falcon Cloud. The Falcon agent must have an active heartbeat to the Falcon Cloud to receive the 'Isolate' command.

Answer

The agent must be in 'Aggressive' sensor mode

Answer

The host must have full disk encryption disabled

Answer

The host must be in a 'Managed' group with full administrative rights

Question 7

In Tenable.io, when prioritizing vulnerability remediation, which metric provides the best insight into the likelihood of a vulnerability being exploited in the wild?

Accepted Answer

Vulnerability Priority Rating (VPR). The Vulnerability Priority Rating (VPR) incorporates threat intelligence and exploit code availability, making it more accurate for risk-based prioritization than CVSS alone.

Answer

Plugin Family

Answer

Asset Criticality Rating

Answer

CVSS Base Score

Question 8

In Splunk Enterprise Security, which dashboard should the SOC manager review to evaluate the effectiveness of the current correlation searches and the volume of notable events?

Accepted Answer

Content Management Dashboard. The Content Management dashboard provides insights into the performance, trigger volume, and status of correlation searches.

Answer

Threat Intelligence Dashboard

Answer

Asset Center

Answer

Incident Review Dashboard

Question 9

When analyzing network traffic in Wireshark for potential exfiltration, what specific filter allows you to isolate TCP traffic where the payload size exceeds 10MB?

Accepted Answer

tcp.len > 10000000. While Wireshark does not have a single simple filter for payload size without complex length calculations, the correct syntax involves identifying TCP segments that contain payload.

Answer

frame.size > 10000000

Answer

ip.len > 10000000

Answer

tcp.payload.size > 10000000

Question 10

Which phase of the NIST Incident Response Life Cycle involves activities like system sanitization and validation of system integrity?

Accepted Answer

Containment, Eradication, and Recovery. Recovery includes restoring systems to normal operation and confirming they are secure.

Answer

Post-Incident Activity

Answer

Detection and Analysis

Answer

Preparation

Question 11

In Okta, to restrict administrative access to a specific geographic region during an active session, which policy should be modified?

Accepted Answer

Global Session Policy. The 'Global Session Policy' or specific 'Authentication Policy' rules control access based on location-based conditions.

Answer

Password Policy

Answer

MFA Enrollment Policy

Answer

Group Rule

Question 12

When configuring a Cisco ASA firewall to log deny events to a remote Syslog server, what is the minimum logging level required to ensure that denied packets are captured?

Accepted Answer

Level 6 (Informational). Level 6 (Informational) is required to capture the 'Deny' flow logs in Cisco ASA systems.

Answer

Level 7 (Debugging)

Answer

Level 4 (Warnings)

Answer

Level 3 (Errors)

Question 13

In VMware Carbon Black Cloud, which feature should be enabled to block unauthorized scripts while allowing signed binaries from trusted software vendors?

Accepted Answer

Advanced Threat Prevention (ATP). The 'Advanced Threat Prevention' policies allow for specific exclusion and blocking rules based on file reputation and signing certificates.

Answer

Watchlists

Answer

Policy Bypass

Answer

Live Query

Question 14

Which SOC metric is most appropriate to present to executive leadership to demonstrate the business value of security investments?

Accepted Answer

Reduction in Mean Time to Remediate (MTTR). Executive leadership cares about the reduction in risk and the financial impact of incidents, not technical metrics like 'events per second'.

Answer

Total number of firewall rules

Answer

Disk space usage of the SIEM

Answer

Number of dropped packets per day

Question 15

A security analyst is troubleshooting a failed connection to an internal application that is protected by Zscaler Private Access (ZPA). Which tool should the analyst use to verify if the policy is blocking the request?

Accepted Answer

ZPA Diagnostics. The Zscaler 'Diagnostics' or 'Insights' portal provides detailed logs on why a specific user-to-app connection was denied or allowed.

Answer

Cloud Connector Log

Answer

App Connector Dashboard

Answer

Policy Simulation Tool

Question 16

Which component in the MITRE ATT&CK framework should be mapped to an SOC alerting rule to ensure the alert covers a specific adversary objective?

Accepted Answer

Technique. The 'Technique' ID is the core component that describes the 'how' of an adversary's action.

Answer

Tactic

Answer

Platform

Answer

Group

Question 17

When managing a FortiGate firewall, which feature allows the SOC to dynamically update network objects based on external threat feeds?

Accepted Answer

External Connectors. FortiGate 'External Connectors' allow the ingestion of dynamic threat intelligence lists.

Answer

DHCP Server

Answer

Traffic Shaper

Answer

Virtual Domains (VDOMs)

Question 18

A Microsoft Entra ID (Azure AD) user account is suspected of compromise. What is the most effective way to invalidate all active session tokens immediately?

Accepted Answer

Revoke sessions. The 'Revoke sessions' action in the Entra ID user blade forces the user to re-authenticate and clears all current refresh tokens.

Answer

Disable the user account

Answer

Remove assigned licenses

Answer

Reset the password

Question 19

In Rapid7 InsightVM, what is the best way to categorize assets into groups based on their business function for targeted vulnerability reporting?

Accepted Answer

Dynamic Asset Groups. Asset groups allow for logical organization of infrastructure based on attributes like department or function.

Answer

User role

Answer

Scan template

Answer

Site configuration

Question 20

When implementing FIM (File Integrity Monitoring) in Tripwire Enterprise, what is the specific purpose of a 'Promotion' action?

Accepted Answer

To update the baseline with the current file state. Promotion updates the 'Known Good' baseline with the state of the monitored file from a current scan.

Answer

To revert a file to its previous version

Answer

To deploy the file to all servers

Answer

To archive the file for legal hold