Cybersecurity-Apprentice Security Operations Practice Test 4 — 15 Questions

Question 1

A security analyst is reviewing a SIEM alert about multiple failed login attempts followed by a successful login from an unusual geographic location. The analyst suspects a compromised account. Which TWO actions should the analyst take to validate and respond to this potential incident? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review authentication logs for the user to confirm the successful login and its source.. To validate a suspected compromised account, the analyst should review authentication logs to confirm the login details and check the user's recent activity for signs of misuse. These actions provide evidence before taking disruptive containment steps like disabling the account or resetting credentials.

Answer

Reset the user's password and enable multi-factor authentication.

Answer

Notify the user's manager about the potential compromise.

Answer

Disable the user's account immediately.

Question 2

A security analyst at a managed security service provider (MSSP) is triaging a phishing alert that was escalated from a customer's email gateway. The customer's environment includes Microsoft 365 and Palo Alto Networks Cortex XDR. The analyst needs to determine whether the potentially malicious URL in the email was ever clicked by any user in the customer's tenant. Which data source should the analyst query first to efficiently identify any user interaction with the URL?

Accepted Answer

Microsoft 365 Defender advanced hunting using the UrlClickEvents table to see which users clicked the URL and when.. Microsoft 365 Defender advanced hunting's UrlClickEvents table is specifically designed to log user clicks on URLs from emails, Teams messages, and other Office 365 services. It provides the necessary user and timestamp details to quickly determine if any user interacted with the malicious link. This is the most direct and efficient method in a Microsoft 365 environment, avoiding the need to correlate multiple disparate logs.

Answer

Cortex XDR incident view filtered by the email sender's address to identify related alerts.

Answer

Cortex XDR XQL query on the network_story dataset for DNS or HTTP events that match the URL's domain.

Answer

Palo Alto Networks WildFire analysis reports for the URL to see if it was submitted and determined malicious.

Question 3

A security analyst is documenting the chain of custody for a hard drive that was seized from a suspect's computer. Which of the following is the PRIMARY purpose of maintaining a chain of custody?

Accepted Answer

To ensure the evidence is admissible in court.. Chain of custody is a legal document that records the seizure, transfer, and analysis of evidence. Its primary purpose is to ensure evidence integrity and admissibility in court. While location tracking, access prevention, and audit compliance are related, they are not the main reason for maintaining it.

Answer

To track the location of the evidence within the organization.

Answer

To comply with internal audit requirements.

Answer

To prevent unauthorized access to the evidence.

Question 4

A Tier-1 SOC analyst receives an alert indicating that a workstation's host-based antivirus quarantined a known malware binary. The analyst must follow the organization's standard operating procedure for confirmed malware containment. Which action should the analyst take FIRST?

Accepted Answer

Isolate the affected workstation from the network and preserve volatile evidence.. For confirmed malware on an endpoint, the SOC playbook prioritizes containment while preserving volatile evidence. Isolating the workstation stops lateral movement, and capturing memory and active connections supports later forensic analysis. Rebooting, rescanning, or deleting the file and closing the alert either destroys evidence or skips required investigation and escalation steps, leaving the environment at risk.

Answer

Delete the quarantined file and close the alert as resolved.

Answer

Immediately reboot the workstation to clear the infection from memory.

Answer

Run a full antivirus scan and wait for the results before notifying anyone.

Question 5

A Tier-1 SOC analyst is monitoring the queue and receives an alert from the endpoint protection platform indicating that a known malware signature was detected and quarantined on a user's workstation. According to standard incident response procedures, what is the MOST appropriate immediate action for the analyst to take?

Accepted Answer

Verify the quarantine action succeeded and check for additional indicators on the endpoint.. After an endpoint protection platform reports a quarantined malware detection, the Tier-1 analyst should confirm the quarantine was successful and look for any related suspicious activity on the endpoint. This verifies containment and informs whether escalation or further remediation is required. Immediate escalation or isolation without validation can be inefficient or disruptive.

Answer

Immediately isolate the endpoint from the network to prevent potential spread.

Answer

Document the alert as a false positive and close it without further action.

Answer

Escalate the alert to Tier-2 for further analysis and potential containment.

Question 6

A SOC analyst is reviewing a Cortex XSIAM alert for a suspicious PowerShell script execution. The analyst wants to see the full command line and the parent process of the PowerShell process. Which Cortex XSIAM feature should the analyst use?

Accepted Answer

Process Tree. The Process Tree feature in Cortex XSIAM visualizes the parent-child relationships of processes and includes the full command line for each process. This allows the analyst to see exactly how the PowerShell script was executed and what spawned it. Other features like Alert Details or Threat Hunting do not offer this specific view.

Answer

Incident Response

Answer

Threat Hunting

Answer

Alert Details

Question 7

A SOC analyst is reviewing an alert generated by the SIEM correlation rule for multiple failed logins followed by a successful login from an unusual geographic location. The account belongs to a finance employee who is currently traveling abroad. What is the MOST appropriate next step for the analyst?

Accepted Answer

Contact the user through a verified out-of-band channel to confirm the login activity.. When a login anomaly could be legitimate travel or a compromise, the analyst should verify with the user through a trusted out-of-band channel. This confirms intent without alerting an attacker and avoids unnecessary disruption. Disabling, closing as false positive, or resetting credentials all skip this verification step and can either harm business operations or miss a real account takeover.

Answer

Close the alert as a false positive because the user is traveling abroad.

Answer

Immediately disable the user's account and escalate to Tier-2.

Answer

Reset the user's password and require re-enrollment in multi-factor authentication.

Question 8

A SOC analyst is reviewing a potential data exfiltration alert from a next-generation firewall. The alert indicates a large outbound transfer to an unknown external IP over TCP port 443. The analyst needs to determine if this is malicious or benign. Which of the following actions should the analyst take FIRST to gather the most relevant context?

Accepted Answer

Query the endpoint detection and response (EDR) platform for process and network activity on the internal host that initiated the transfer.. The first step should be to query the EDR platform for process and network activity on the internal host. This provides the most direct and detailed context about what initiated the transfer, including the process name, command line, and parent process. That information is critical to quickly assess whether the transfer is malicious or benign, and it can guide subsequent steps such as threat intelligence lookups or firewall log reviews.

Answer

Check the firewall's threat logs for any associated WildFire verdicts on the files or URLs involved.

Answer

Review the firewall's traffic logs to identify the user and application associated with the session.

Answer

Look up the external IP address in an open-source threat intelligence platform to see if it is associated with known malicious activity.

Question 9

A SOC analyst is triaging a malware alert in Cortex XDR. The analyst needs to determine the scope of the infection by identifying other endpoints that communicated with the same malicious domain. Which TWO actions should the analyst take to achieve this? (Choose two.)

Accepted Answer

Use the Cortex XDR Query Builder to search for network connections to the malicious domain across all endpoints.. To determine the scope of a malware infection, the analyst needs to search across all endpoints for communication with the malicious domain. Using the Cortex XDR Query Builder or XQL allows for custom queries that filter network events by domain and time frame, identifying all affected endpoints. Other actions like reviewing a single incident timeline or endpoint inventory do not provide this cross-endpoint visibility.

Answer

Review the Cortex XDR Incident Timeline for the original alert to see related endpoints.

Answer

Use the Cortex XDR Causality Chain to view the process that initiated the connection and then pivot to other endpoints.

Answer

Check the Cortex XDR Endpoint Inventory for endpoints with similar operating system versions.

Question 10

A SOC analyst is triaging a phishing report submitted by an employee. The email contains a link to a credential-harvesting page that mimics the organization's webmail portal. The analyst has confirmed the URL is malicious. Which action should the analyst take to protect other users while preserving evidence?

Accepted Answer

Add the malicious URL to the web proxy blocklist, hunt for other recipients, and reset credentials for users who clicked.. A confirmed phishing URL requires immediate containment that stops further clicks and remediates users who already submitted credentials. Blocking the URL, hunting for other recipients, and resetting compromised credentials accomplishes both goals while preserving evidence. Replying to the attacker, mass-forwarding the live email, or only blocking the sender domain leaves credential compromise unaddressed and can increase exposure.

Answer

Forward the phishing email to all employees as a training example and ask them to delete it.

Answer

Block the sender's domain at the email gateway and delete all copies of the message from user mailboxes.

Answer

Reply to the phishing email warning the sender to stop and ask them to remove the malicious link.

Question 11

A security analyst is reviewing a suspicious PowerShell script that was executed on a user's workstation. The script attempted to download a file from a remote server and execute it in memory. Which TWO Windows event log sources would provide the MOST relevant information to investigate this activity? (Choose two.)

Accepted Answer

Microsoft-Windows-Sysmon/Operational log. The PowerShell Operational log and Sysmon Operational log are the most relevant sources. The PowerShell Operational log captures script block logging and execution details, while Sysmon provides process creation with command lines and network connection events. Together, they allow the analyst to reconstruct the script's behavior, including the download attempt and in-memory execution, which are critical for incident response.

Answer

Microsoft-Windows-Windows Defender/Operational log

Answer

Security log

Answer

Microsoft-Windows-TaskScheduler/Operational log

Question 12

A Tier-1 SOC analyst receives an alert from Cortex XDR indicating that a process on a Windows endpoint attempted to disable Windows Defender real-time protection. The analyst needs to gather the process name, command line, and parent process to decide whether to escalate. Which Cortex XDR console area should the analyst open to review this endpoint telemetry most directly?

Accepted Answer

Incident Response > Investigation, filtering on the endpoint hostname and the alert timestamp. Endpoint triage requires event-level evidence: which process ran, what command line it used, and what process spawned it. The Investigation view in Cortex XDR surfaces exactly that causal telemetry and supports filtering by host and time, so an analyst can reconstruct the activity around the alert. Aggregated dashboards, asset inventory records, and prevention profiles describe posture or counts, not the specific process behavior under investigation.

Answer

Inventory > Endpoints, opening the asset record for the affected host

Answer

Policy > Prevention, reviewing the endpoint protection profile assigned to the host

Answer

Dashboards > Endpoint Security, reviewing the aggregate malware detection widget

Question 13

A SOC analyst is investigating a potential data exfiltration incident. The analyst observes that a workstation has been communicating with an external IP address using DNS queries that contain long, random-looking subdomains. The volume of these queries is high, and the subdomains change frequently. Which type of attack is most likely occurring?

Accepted Answer

DNS tunneling for data exfiltration. The scenario describes a workstation sending numerous DNS queries with long, random subdomains to an external IP. This behavior is typical of DNS tunneling, where attackers encode stolen data into DNS queries to bypass network defenses. The high volume and changing subdomains indicate data exfiltration over DNS, making DNS tunneling the most likely attack.

Answer

Domain Generation Algorithm (DGA) communication

Answer

Fast flux DNS

Answer

DNS cache poisoning

Question 14

A SOC analyst notices that an internal server is making repeated DNS queries for randomly generated domain names, and the queries are failing with NXDOMAIN responses. The server is not scheduled to run any new applications. Which type of malicious activity does this pattern MOST likely indicate?

Accepted Answer

A domain generation algorithm used by malware for command-and-control.. Repeated NXDOMAIN responses for randomly generated domains from an unscheduled internal server is a classic indicator of a domain generation algorithm used by malware to find its command-and-control infrastructure. The analyst should treat the host as potentially compromised, isolate it, and investigate for malware. DNS tunneling, load balancing health checks, and resolver DoS do not match the random failing query pattern.

Answer

A misconfigured application performing a DNS-based load balancing health check.

Answer

A DNS tunneling exfiltration channel encoding stolen data in query strings.

Answer

A denial-of-service attack against the internal DNS resolver.

Question 15

A SOC analyst is triaging an alert for a suspicious login to a cloud-based email service. The alert indicates a successful login from an IP address in a foreign country, but the user typically works from the United States. The analyst checks the user's recent activity and sees that the login occurred outside normal working hours. Which of the following actions should the analyst take NEXT to determine if the login is malicious?

Accepted Answer

Contact the user to verify if they initiated the login from that location.. The next step should be to contact the user to verify whether they initiated the login. This is a non-disruptive action that can quickly clarify whether the login is legitimate, such as if the user is traveling or using a VPN. If the user denies the login, the analyst can then proceed with containment actions like password reset and session revocation, and further investigate for compromise.

Answer

Reset the user's password and revoke all active sessions immediately.

Answer

Block the foreign IP address on the firewall to prevent further access.

Answer

Review the user's mailbox audit logs for any suspicious email forwarding rules or file downloads.