Scenario practice questions

A security operations center (SOC) analyst is tuning a SIEM correlation rule to detect lateral movement using pass-the-hash attacks. The analyst wants to minimize false positives while ensuring detection of true positives. Which approach is most effective for reducing false positives in this scenario?

Trap 1: Alert on any use of NTLM authentication

NTLM is commonly used, leading to many false positives.

Trap 2: Alert on multiple failed logins followed by a successful login from…

This may indicate brute force, not specifically pass-the-hash.

Trap 3: Disable NTLM authentication across the network

This is an extreme measure and not a detection tuning technique.

A
Alert on any use of NTLM authentication
Why wrong: NTLM is commonly used, leading to many false positives.
B
Alert on multiple failed logins followed by a successful login from a different workstation
Why wrong: This may indicate brute force, not specifically pass-the-hash.
C
Disable NTLM authentication across the network
Why wrong: This is an extreme measure and not a detection tuning technique.
D
Compare authentication events against a baseline of normal user behavior and alert on anomalies
UBA techniques help identify unusual authentication patterns indicative of pass-the-hash.

Question 2hardmultiple choice

A security analyst is investigating a potential advanced persistent threat (APT) that has evaded traditional signature-based defenses. The analyst hypothesizes that the attacker is using a specific technique from the MITRE ATT&CK framework: process injection. Which threat hunting methodology is most appropriate for this scenario?

Trap 1: TTP-driven hunting by analyzing adversary behaviors mapped to the…

TTP-driven hunting is similar but broader; the scenario specifically starts with a hypothesis about a technique, which is more aligned with hypothesis-driven hunting.

Trap 2: Automated hunting using SIEM correlation rules that trigger on…

This is reactive and signature-based; it would miss novel attacks that do not match known hashes.

Trap 3: IoC-driven hunting using known indicators of compromise from…

IoC-driven hunting relies on known IOCs, which an APT may not have left behind; it is reactive.

A
TTP-driven hunting by analyzing adversary behaviors mapped to the ATT&CK framework
Why wrong: TTP-driven hunting is similar but broader; the scenario specifically starts with a hypothesis about a technique, which is more aligned with hypothesis-driven hunting.
B
Hypothesis-driven hunting based on a specific technique (process injection) and searching for evidence in memory and process activity
Hypothesis-driven hunting starts with a hypothesis about adversary behavior and proactively searches for evidence, making it ideal for detecting novel or evasive techniques.
C
Automated hunting using SIEM correlation rules that trigger on known malicious file hashes
Why wrong: This is reactive and signature-based; it would miss novel attacks that do not match known hashes.
D
IoC-driven hunting using known indicators of compromise from open-source feeds
Why wrong: IoC-driven hunting relies on known IOCs, which an APT may not have left behind; it is reactive.

Question 3hardmultiple choice

During a penetration test, the tester successfully gains initial access to a web server and wants to move laterally to a database server. The web server uses a service account that has local admin rights on the database server. What is the most effective technique for lateral movement in this scenario?

Trap 1: Exploit a SQL injection vulnerability in the database server

Assumes a vulnerability; lateral movement via credentials is more direct.

Trap 2: Brute-force the database server administrator password

Inefficient and noisy; the hash is already available.

Trap 3: Use a keylogger to capture credentials on the web server

Unnecessary if the hash is already obtainable.

A
Exploit a SQL injection vulnerability in the database server
Why wrong: Assumes a vulnerability; lateral movement via credentials is more direct.
B
Brute-force the database server administrator password
Why wrong: Inefficient and noisy; the hash is already available.
C
Use a keylogger to capture credentials on the web server
Why wrong: Unnecessary if the hash is already obtainable.
D
Pass-the-Hash
The service account's hash can be used to authenticate to the database server.

Study the full ACL explanation →

Question 4easymultiple choice

A security architect reviews this Cisco router ACL configuration. The web server at 192.168.1.100 is accessible from the internet. What additional security measure should be implemented to protect the internal network (10.0.0.0/24)?

Exhibit

Refer to the exhibit.

```
interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip access-group OUTSIDE_IN in
!
ip access-list extended OUTSIDE_IN
 permit tcp any host 192.168.1.100 eq 80
 permit tcp any host 192.168.1.100 eq 443
 deny   ip any any log
! 
interface GigabitEthernet0/1
 ip address 10.0.0.1 255.255.255.0
 ip access-group INSIDE_OUT out
!
ip access-list extended INSIDE_OUT
 permit ip 10.0.0.0 0.0.0.255 any
 deny   ip any any log
```

Trap 1: Remove the log statement from the deny rules to improve performance

Removing logging reduces visibility without improving security; logging is important for monitoring.

Trap 2: Add an ACL on GigabitEthernet0/1 to limit outbound traffic to web…

Limiting outbound to web ports may be too restrictive and not address all threats; stateful firewall is better.

Trap 3: Apply the same OUTSIDE_IN ACL to GigabitEthernet0/1 inbound

This would block all incoming traffic, including legitimate internal traffic, and is not appropriate.

A
Remove the log statement from the deny rules to improve performance
Why wrong: Removing logging reduces visibility without improving security; logging is important for monitoring.
B
Add an ACL on GigabitEthernet0/1 to limit outbound traffic to web ports only
Why wrong: Limiting outbound to web ports may be too restrictive and not address all threats; stateful firewall is better.
C
Replace the ACLs with a stateful firewall that inspects connection states
A stateful firewall provides deeper inspection and can prevent various attacks.
D
Apply the same OUTSIDE_IN ACL to GigabitEthernet0/1 inbound
Why wrong: This would block all incoming traffic, including legitimate internal traffic, and is not appropriate.

Question 5hardmultiple choice

A security analyst reviews the above Windows security events from a domain controller. What is the most likely conclusion about the activity?

Exhibit

Refer to the exhibit.

```
Event: 4625 (An account failed to log on)
Account Name: Administrator
Source Network Address: 10.10.10.50
Logon Type: 3 (Network)
Status: 0xC000006D (bad username or password)

Event: 4624 (An account was successfully logged on)
Account Name: jsmith
Source Network Address: 10.10.10.50
Logon Type: 2 (Interactive)

Event: 4672 (Special privileges assigned to new logon)
Account Name: jsmith
Privileges: SeTcbPrivilege, SeDebugPrivilege

Event: 5140 (A network share object was accessed)
Account Name: jsmith$
Accesses: WriteData (or AddFile)
Share Name: \\*\C$
```

Trap 1: The jsmith account is performing routine administrative tasks with…

The event 4672 shows special privileges (SeTcbPrivilege, SeDebugPrivilege) that are not standard for a typical user.

Trap 2: The Administrator account is locked out due to repeated failed…

Lockout would generate a different event (4740), and there is a successful logon right after, so not lockout.

Trap 3: A user named jsmith is attempting to reset the Administrator…

The logon type for jsmith is interactive (2), not network (3), and the privileges indicate escalation, not password reset.

A
The jsmith account is performing routine administrative tasks with standard user privileges.
Why wrong: The event 4672 shows special privileges (SeTcbPrivilege, SeDebugPrivilege) that are not standard for a typical user.
B
An attacker has compromised the jsmith account and used it to perform lateral movement and access sensitive data.
The sequence matches typical PtH: failed logon as admin, then successful interactive logon with high privileges, then accessing admin share.
C
The Administrator account is locked out due to repeated failed logon attempts.
Why wrong: Lockout would generate a different event (4740), and there is a successful logon right after, so not lockout.
D
A user named jsmith is attempting to reset the Administrator password via network logon.
Why wrong: The logon type for jsmith is interactive (2), not network (3), and the privileges indicate escalation, not password reset.

Question 6hardmultiple choice

Given the exhibit, what is the MOST likely scenario?

Exhibit

Refer to the exhibit.

```
[timestamp] firewall: Deny TCP 10.0.1.100:54321 -> 203.0.113.5:80 (Drop)
[timestamp] firewall: Allow TCP 10.0.1.100:54322 -> 203.0.113.5:443 (Allow)
[timestamp] IDS: Alert - SQL Injection attempt detected from 10.0.1.100 to 203.0.113.5:443
[timestamp] web_server: HTTP POST /login.php with sql_injection_pattern
```

Trap 1: A misconfigured application is sending malformed data to a server.

The pattern of SQL injection is intentional, not misconfiguration.

Trap 2: An external attacker is scanning the internal network.

All source IPs are internal 10.0.1.100.

Trap 3: A web vulnerability scanner is performing authorized tests.

The SQL injection alert suggests malicious intent, and there's no authorization indication.

A
A misconfigured application is sending malformed data to a server.
Why wrong: The pattern of SQL injection is intentional, not misconfiguration.
B
An external attacker is scanning the internal network.
Why wrong: All source IPs are internal 10.0.1.100.
C
An internal host is compromised and attacking an external web server.
The host adapts to firewall rules and launches SQL injection attack.
D
A web vulnerability scanner is performing authorized tests.
Why wrong: The SQL injection alert suggests malicious intent, and there's no authorization indication.

Question 7hardmultiple choice

A multinational corporation must comply with both the EU's GDPR and the California Consumer Privacy Act (CCPA). Which of the following scenarios would cause a conflict between these regulations?

Trap 1: One regulation requires breach notification, the other does not

Both require breach notification.

Trap 2: CCPA imposes data minimization, while GDPR does not

Both have data minimization principles.

Trap 3: Both require data access rights for individuals

Both grant data access rights.

A
GDPR requires explicit consent for data processing, while CCPA allows opt-out for data sale
Consent vs opt-out can conflict.
B
One regulation requires breach notification, the other does not
Why wrong: Both require breach notification.
C
CCPA imposes data minimization, while GDPR does not
Why wrong: Both have data minimization principles.
D
Both require data access rights for individuals
Why wrong: Both grant data access rights.

Question 8mediummultiple choice

A healthcare organization has suffered a ransomware attack. The ransomware encrypted all files on file servers and workstations, and a ransom note demands payment in cryptocurrency. The backup systems were also encrypted because the backup service account had write access to the backup repository. The organization's cybersecurity team has activated the incident response plan. Which of the following is the BEST course of action?

Trap 1: Restore data from the encrypted backups using a third-party…

Encrypted backups are useless without decryption.

Trap 2: Begin restoring systems from any clean backups located on removable…

Restoration should follow containment and verification that systems are clean.

Trap 3: Pay the ransom to obtain the decryption key and restore operations…

Paying is not recommended and may not work.

A
Restore data from the encrypted backups using a third-party decryption tool.
Why wrong: Encrypted backups are useless without decryption.
B
Isolate all affected systems from the network immediately to prevent further encryption.
Containment stops the spread and limits damage.
C
Begin restoring systems from any clean backups located on removable media.
Why wrong: Restoration should follow containment and verification that systems are clean.
D
Pay the ransom to obtain the decryption key and restore operations quickly.
Why wrong: Paying is not recommended and may not work.