Security Operations practice questions

Export the Windows event logs related to network activity

Why wrong: Event logs are less volatile than memory but still should be collected after memory.

Execute a network scan from the compromised host to identify active connections

Why wrong: Running commands on a live system can alter evidence and should be avoided; memory capture is preferred.

Capture a full disk image using FTK Imager

Why wrong: Disk imaging is important but captures non-volatile data; volatile data would be lost if the system is shut down first.

TTP-driven hunting by analyzing adversary behaviors mapped to the ATT&CK framework

Why wrong: TTP-driven hunting is similar but broader; the scenario specifically starts with a hypothesis about a technique, which is more aligned with hypothesis-driven hunting.

Automated hunting using SIEM correlation rules that trigger on known malicious file hashes

Why wrong: This is reactive and signature-based; it would miss novel attacks that do not match known hashes.

IoC-driven hunting using known indicators of compromise from open-source feeds

Why wrong: IoC-driven hunting relies on known IOCs, which an APT may not have left behind; it is reactive.

An automatic rollback script that restores quarantined emails after 24 hours if no user complaint

Why wrong: Automatic rollback could reintroduce malicious content and does not address the need for oversight.

Integration with threat intelligence to verify the sender domain reputation score before blocking

Why wrong: While threat intel helps, it may not prevent all false positives; the question asks about avoiding unintended disruption.

A manual approval step before executing any automated response

Why wrong: Full manual approval defeats the purpose of automation; a better approach is conditional approval only for high-risk actions.

The number of other vulnerabilities in the same software product

Why wrong: This is not part of the CVSS scoring system; prioritization should consider individual vulnerability risk.

The age of the vulnerability since its disclosure

Why wrong: Age is not a formal CVSS metric; temporal metrics include exploit maturity, but environmental is more relevant here.

Temporal metrics including exploit code maturity and remediation level

Why wrong: Temporal metrics adjust for current exploit status, but the scenario says it is not exploited; however, environmental metrics are more relevant for organizational context.

SQL injection

Why wrong: SQL injection is typically used for initial access, not lateral movement between servers.

Cross-site scripting (XSS)

Why wrong: XSS is a web application attack, not used for lateral movement in network environments.

ARP spoofing

Why wrong: ARP spoofing is a man-in-the-middle technique on local networks, not typical for lateral movement between servers.

A network-based intrusion detection system (NIDS) on the segment

Why wrong: NIDS may detect known attack patterns but can miss novel lateral movement techniques.

A honeypot configured to mimic a high-value database server

Why wrong: Honeypots can detect reconnaissance, but a honeytoken is more specific to credential use and lateral movement.

An endpoint detection and response (EDR) agent on all workstations

Why wrong: EDR is useful but may not specifically detect credential misuse without additional rules.

A misconfigured VPN that routes traffic through multiple gateways

Why wrong: VPN misconfiguration might cause different source IPs, but not necessarily impossible travel times.

A brute-force attack on the user account

Why wrong: Brute-force would show multiple failed logins, not successful logins from distant locations.

A man-in-the-middle attack intercepting the authentication

Why wrong: MITM attacks would not necessarily cause logins from different locations.

They are tools for analyzing malware behavior in a sandbox environment

Why wrong: STIX/TAXII are not analysis tools; they are for data sharing.

They are used to automatically patch vulnerabilities based on threat feeds

Why wrong: STIX/TAXII do not perform patching; they share threat information.

They provide a framework for conducting incident response exercises

Why wrong: STIX/TAXII are not for exercises; they are for threat intelligence sharing.

Open-source intelligence (OSINT) gathering by examining the target's website source code

Why wrong: While OSINT can be passive, enumerating subdomains via DNS queries is active.

Social engineering because the tester tricked an employee into revealing the subdomain

Why wrong: No social engineering involved; the subdomain was found through technical means.

Passive reconnaissance because the tester is using publicly available information

Why wrong: Using DNS scans or tools to enumerate subdomains is active because it involves direct requests to the target's servers.

Pull the power cord to preserve the disk state

Why wrong: Pulling power loses volatile data; it is better to capture memory first.

Create a forensic image of the hard drive using dd over a network connection

Why wrong: Disk imaging should be done after capturing volatile data, and over a network may alter evidence.

Run the 'history' command to see recent user commands

Why wrong: Running commands on a live system can alter evidence; memory capture should be prioritized.

XDR only works with a single vendor's products

Why wrong: XDR can integrate with multiple products, though some solutions are vendor-specific.

XDR eliminates the need for SIEM and SOAR systems

Why wrong: XDR complements SIEM/SOAR but does not replace them entirely.

XDR only focuses on network traffic analysis

Why wrong: XDR covers multiple sources, not just network.

pslist

Why wrong: pslist lists processes from the EPROCESS list but may not detect hidden processes that are unlinked from that list.

malfind

Why wrong: malfind identifies injected code, not hidden processes.

pstree

Why wrong: pstree shows parent-child relationships but relies on the same EPROCESS list.

Run a full antivirus scan on all systems

Why wrong: Scanning is not a containment action and may be slow; isolation and blocking are more immediate.

Restore all systems from the latest backup automatically

Why wrong: Automated restoration without verification could reintroduce the infection or cause data loss.

Power off all affected servers immediately

Why wrong: Powering off may cause data loss and prevent forensic analysis; containment is preferred.

Network analysis using Wireshark to capture packets from the sandbox

Why wrong: While network analysis is useful, it may not reveal the malware's internal logic or anti-debugging.

Hash analysis by submitting the malware to VirusTotal

Why wrong: Hash analysis is passive and does not provide in-depth understanding of the malware's capabilities.

Conducting social engineering attacks against employees without prior approval

Why wrong: Social engineering requires separate approval and could disrupt operations if not coordinated.

Performing a distributed denial-of-service (DDoS) attack to test resilience

Why wrong: DoS attacks are explicitly prohibited by the rules of engagement.

Eradication

Why wrong: Eradication removes the threat, but does not involve restoring normal operations.

Containment

Why wrong: Containment stops the spread but does not restore systems.

Lessons Learned

Why wrong: Lessons Learned occurs after recovery, focusing on process improvement.

Defense Evasion

Why wrong: Defense Evasion involves avoiding detection, not execution.

Initial Access

Why wrong: Initial Access involves gaining entry, not running code.

Command and Control

Why wrong: Command and Control involves communication with adversary systems.

Alert when a host sends >10 MB to an external IP not in the whitelist and the destination port is 443.

Why wrong: Unnecessarily restricts to port 443; may miss exfiltration over other ports.

Alert when any host sends >10 MB to an external IP not in the whitelist within 5 minutes.

Why wrong: Does not check if the destination IP is new.

Alert when a host sends >10 MB to any external IP aggregated over 5 minutes, then filter out whitelisted IPs.

Why wrong: Does not check if the IP is new.

Running a port scan on the internal network

Why wrong: Port scans identify services but do not provide credentials.

Deploying a web shell for persistent access

Why wrong: Web shell provides persistent access but not credentials.

Conducting a SQL injection on the database server

Why wrong: SQL injection targets the database but requires network access; likely not accessible from web server initially.

The file imports many Windows API functions

Why wrong: Many imports are normal for legitimate programs.

The file has a high entropy score

Why wrong: High entropy indicates encryption/compression but is not directly observed from strings/imports.

The file contains a large number of IP addresses

Why wrong: IP addresses may indicate C2 but not necessarily packing.