Security Operations practice questions

A security analyst receives an alert indicating an internal host is sending outbound traffic on TCP port 25 to multiple external IP addresses. Which action should the analyst take first to investigate potential data exfiltration?

Trap 1: Submit a change request to implement an email content filter.

This is a long-term control, not an immediate investigation step.

Trap 2: Block the outbound traffic on the firewall to prevent potential…

Blocking first may cause service disruption without proper investigation.

Trap 3: Run a full antivirus scan on the host to detect any malware.

This is a later step; initial verification of the host's role is faster and less disruptive.

A
Submit a change request to implement an email content filter.
Why wrong: This is a long-term control, not an immediate investigation step.
B
Check if the host is configured as a mail server in the organization's asset database.
This step quickly confirms if the traffic is expected, avoiding unnecessary escalation.
C
Block the outbound traffic on the firewall to prevent potential data exfiltration.
Why wrong: Blocking first may cause service disruption without proper investigation.
D
Run a full antivirus scan on the host to detect any malware.
Why wrong: This is a later step; initial verification of the host's role is faster and less disruptive.

Question 2mediummultiple choice

A SOC analyst is reviewing a large volume of failed login attempts across multiple user accounts from a single external IP address. The attempts use common usernames and passwords over SSH (port 22). Which security control would be most effective at preventing this type of attack?

Trap 1: Enforce a minimum password complexity policy for all users.

Password complexity reduces the chance of successful authentication but does not prevent the attack.

Trap 2: Require multi-factor authentication for all SSH logins.

MFA prevents successful authentication but the attack still generates logs and resource usage.

Trap 3: Implement rate limiting on SSH connections per source IP.

Rate limiting slows down but does not stop a determined attacker; the source IP can still attempt logins.

A
Enforce a minimum password complexity policy for all users.
Why wrong: Password complexity reduces the chance of successful authentication but does not prevent the attack.
B
Require multi-factor authentication for all SSH logins.
Why wrong: MFA prevents successful authentication but the attack still generates logs and resource usage.
C
Implement rate limiting on SSH connections per source IP.
Why wrong: Rate limiting slows down but does not stop a determined attacker; the source IP can still attempt logins.
D
Add the external IP address to the firewall deny list and implement an IP allowlist for SSH access.
This immediately blocks the attack and prevents any further attempts from that IP.

Question 3hardmultiple choice

An organization deploys a new web application that stores sensitive data in a backend database. During a penetration test, the tester discovers that the application is vulnerable to SQL injection via a search field. Which of the following design changes would best mitigate this vulnerability without significantly impacting functionality?

Trap 1: Deploy a web application firewall (WAF) to filter malicious…

A WAF is a layer of defense but can be bypassed and does not fix the underlying code vulnerability.

Trap 2: Move all database queries to stored procedures.

Stored procedures can still be vulnerable if they dynamically construct SQL; they are not a guaranteed fix.

Trap 3: Implement client-side input validation to block special characters.

Client-side validation is easily bypassed; server-side validation is needed, but even then, blacklisting is not reliable.

A
Deploy a web application firewall (WAF) to filter malicious payloads.
Why wrong: A WAF is a layer of defense but can be bypassed and does not fix the underlying code vulnerability.
B
Rewrite the database query to use parameterized prepared statements.
Parameterized queries ensure user input is treated as data, not executable code, preventing SQL injection.
C
Move all database queries to stored procedures.
Why wrong: Stored procedures can still be vulnerable if they dynamically construct SQL; they are not a guaranteed fix.
D
Implement client-side input validation to block special characters.
Why wrong: Client-side validation is easily bypassed; server-side validation is needed, but even then, blacklisting is not reliable.

Question 4mediummultiple choice

A security engineer is configuring a SIEM and wants to reduce false positives while ensuring that real attacks are detected. Which of the following approaches would best achieve this balance?

Trap 1: Aggregate all logs from all sources and create a single correlation…

This approach would likely generate many false positives due to lack of specificity and context.

Trap 2: Use the default correlation rules provided by the SIEM vendor…

Default rules may not fit the organization's environment, leading to high false positive rates.

Trap 3: Block all traffic from external IP addresses that are not on the…

This is a firewall action, not a SIEM configuration, and would disrupt legitimate traffic.

A
Aggregate all logs from all sources and create a single correlation rule for each attack type.
Why wrong: This approach would likely generate many false positives due to lack of specificity and context.
B
Use the default correlation rules provided by the SIEM vendor without modification.
Why wrong: Default rules may not fit the organization's environment, leading to high false positive rates.
C
Block all traffic from external IP addresses that are not on the organization's whitelist.
Why wrong: This is a firewall action, not a SIEM configuration, and would disrupt legitimate traffic.
D
Tune correlation rules based on the organization's asset inventory, network architecture, and threat intelligence.
Custom tuning ensures rules are relevant and accurate, reducing false positives while detecting true threats.

Question 5easymultiple choice

During a security incident, a forensic investigator needs to capture the contents of volatile memory on a compromised server. Which of the following tools should the investigator use?

Trap 1: dd

dd is used for disk imaging, not memory acquisition.

Trap 2: Wireshark

Wireshark captures network packets, not memory contents.

Trap 3: Nmap

Nmap is used for network discovery and port scanning.

A
dd
Why wrong: dd is used for disk imaging, not memory acquisition.
B
Wireshark
Why wrong: Wireshark captures network packets, not memory contents.
C
FTK Imager (with memory capture)
FTK Imager can capture an image of physical memory (RAM) for analysis.
D
Nmap
Why wrong: Nmap is used for network discovery and port scanning.

Question 6mediummulti select

Which TWO of the following are best practices for securing a cloud-based identity and access management (IAM) system? (Select exactly 2.)

Trap 1: Require users to change passwords every 30 days.

Frequent password changes can lead to weak passwords; modern guidance recommends against arbitrary expiration.

Trap 2: Use single sign-on (SSO) for all applications.

SSO improves user experience but does not inherently secure IAM; it can create a single point of failure.

Trap 3: Create default admin accounts for each department.

Default admin accounts are a security risk; admin accounts should be unique and carefully managed.

A
Require users to change passwords every 30 days.
Why wrong: Frequent password changes can lead to weak passwords; modern guidance recommends against arbitrary expiration.
B
Use single sign-on (SSO) for all applications.
Why wrong: SSO improves user experience but does not inherently secure IAM; it can create a single point of failure.
C
Implement the principle of least privilege for all user roles.
Limiting privileges reduces the attack surface and potential damage.
D
Enable multi-factor authentication (MFA) for all administrative accounts.
MFA adds an extra layer of security beyond passwords.
E
Create default admin accounts for each department.
Why wrong: Default admin accounts are a security risk; admin accounts should be unique and carefully managed.

Question 7hardmulti select

Which THREE of the following are effective techniques for detecting advanced persistent threats (APTs) within a network? (Select exactly 3.)

Trap 1: Using signature-based intrusion detection systems (IDS) to match…

Signature-based detection fails against zero-day exploits and custom malware used by APTs.

Trap 2: Deploying honeypots to attract and analyze attacker behavior.

Honeypots can be useful but are not a primary detection technique; they are more for research and deception.

A
Using signature-based intrusion detection systems (IDS) to match known attack patterns.
Why wrong: Signature-based detection fails against zero-day exploits and custom malware used by APTs.
B
Conducting behavioral analysis of endpoint and network activity to detect unusual patterns.
Behavioral analysis can uncover APT activities such as lateral movement and data exfiltration.
C
Integrating threat intelligence feeds to correlate indicators of compromise (IOCs) with internal logs.
Threat intelligence helps identify known APT tactics, techniques, and procedures (TTPs).
D
Implementing anomaly-based network traffic analysis to identify deviations from baseline behavior.
APTs often exhibit subtle anomalies that can be detected through baseline deviations.
E
Deploying honeypots to attract and analyze attacker behavior.
Why wrong: Honeypots can be useful but are not a primary detection technique; they are more for research and deception.

Question 8hardmultiple choice

A security analyst reviews the above Windows security events from a domain controller. What is the most likely conclusion about the activity?

Exhibit

Refer to the exhibit.

```
Event: 4625 (An account failed to log on)
Account Name: Administrator
Source Network Address: 10.10.10.50
Logon Type: 3 (Network)
Status: 0xC000006D (bad username or password)

Event: 4624 (An account was successfully logged on)
Account Name: jsmith
Source Network Address: 10.10.10.50
Logon Type: 2 (Interactive)

Event: 4672 (Special privileges assigned to new logon)
Account Name: jsmith
Privileges: SeTcbPrivilege, SeDebugPrivilege

Event: 5140 (A network share object was accessed)
Account Name: jsmith$
Accesses: WriteData (or AddFile)
Share Name: \\*\C$
```

Trap 1: The jsmith account is performing routine administrative tasks with…

The event 4672 shows special privileges (SeTcbPrivilege, SeDebugPrivilege) that are not standard for a typical user.

Trap 2: The Administrator account is locked out due to repeated failed…

Lockout would generate a different event (4740), and there is a successful logon right after, so not lockout.

Trap 3: A user named jsmith is attempting to reset the Administrator…

The logon type for jsmith is interactive (2), not network (3), and the privileges indicate escalation, not password reset.

A
The jsmith account is performing routine administrative tasks with standard user privileges.
Why wrong: The event 4672 shows special privileges (SeTcbPrivilege, SeDebugPrivilege) that are not standard for a typical user.
B
An attacker has compromised the jsmith account and used it to perform lateral movement and access sensitive data.
The sequence matches typical PtH: failed logon as admin, then successful interactive logon with high privileges, then accessing admin share.
C
The Administrator account is locked out due to repeated failed logon attempts.
Why wrong: Lockout would generate a different event (4740), and there is a successful logon right after, so not lockout.
D
A user named jsmith is attempting to reset the Administrator password via network logon.
Why wrong: The logon type for jsmith is interactive (2), not network (3), and the privileges indicate escalation, not password reset.

Question 9mediummultiple choice

A cloud security engineer reviews the above S3 bucket policy. Which of the following is the most significant security concern?

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::bucket123/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::bucket123/*",
      "Principal": "*"
    }
  ]
}
```

Trap 1: The bucket policy grants unnecessary permissions for s3:GetObject.

The GetObject permission is appropriately restricted by IP; it's not unnecessary if the use case requires it.

Trap 2: The IP address restriction uses an incorrect format for the…

The format is correct: "aws:SourceIp" with CIDR notation.

Trap 3: The bucket policy allows public read access to all objects.

Read access (s3:GetObject) is restricted to a specific IP range, not public.

A
The bucket policy grants unnecessary permissions for s3:GetObject.
Why wrong: The GetObject permission is appropriately restricted by IP; it's not unnecessary if the use case requires it.
B
The IP address restriction uses an incorrect format for the condition key.
Why wrong: The format is correct: "aws:SourceIp" with CIDR notation.
C
The bucket policy allows public read access to all objects.
Why wrong: Read access (s3:GetObject) is restricted to a specific IP range, not public.
D
The bucket policy allows any user to upload objects to the bucket.
The second statement grants s3:PutObject to Principal "*", meaning anyone can write to the bucket.

Question 10mediummultiple choice

A security analyst notices repeated failed login attempts from a single IP address across multiple user accounts. Which of the following is the BEST immediate action to mitigate this attack?

Trap 1: Disable the affected user accounts until the source IP is blocked.

Disabling accounts is reactive and could disrupt legitimate users.

Trap 2: Reset the passwords for all affected accounts.

Resetting passwords does not stop the attacker from continuing attempts.

Trap 3: Enable multi-factor authentication for all accounts.

MFA is good but does not prevent the network traffic from consuming resources.

A
Disable the affected user accounts until the source IP is blocked.
Why wrong: Disabling accounts is reactive and could disrupt legitimate users.
B
Reset the passwords for all affected accounts.
Why wrong: Resetting passwords does not stop the attacker from continuing attempts.
C
Enable multi-factor authentication for all accounts.
Why wrong: MFA is good but does not prevent the network traffic from consuming resources.
D
Implement a rate-limiting rule on the network firewall for the source IP.
Rate-limiting blocks excessive traffic from the source IP, directly halting the brute-force attempt.

Question 11hardmultiple choice

A SOC analyst is reviewing an alert about a suspicious process execution on a critical server. The alert shows that cmd.exe spawned from Microsoft Word. Which of the following is the BEST next step for the analyst?

Trap 1: Collect a memory dump from the host without any immediate action.

Collecting memory is important but should be done after isolation to preserve evidence.

Trap 2: Reimage the server to ensure it is clean.

Reimaging is premature without understanding the scope.

Trap 3: Terminate the cmd.exe process immediately.

Terminating may leave artifacts and does not prevent reinfection.

A
Collect a memory dump from the host without any immediate action.
Why wrong: Collecting memory is important but should be done after isolation to preserve evidence.
B
Reimage the server to ensure it is clean.
Why wrong: Reimaging is premature without understanding the scope.
C
Isolate the host from the network and collect a memory dump.
Isolation prevents lateral movement; memory dump preserves evidence.
D
Terminate the cmd.exe process immediately.
Why wrong: Terminating may leave artifacts and does not prevent reinfection.

Read the full NAT/PAT explanation →

Question 12easymultiple choice

An organization wants to implement a solution that automatically detects and blocks malicious traffic based on known signatures and behavioral anomalies. Which of the following should be deployed?

Trap 1: Next-generation firewall with application control

A firewall typically works at layers 3-4 and may not inspect application-layer anomalies effectively.

Trap 2: Web application firewall (WAF)

WAF only protects web applications.

Trap 3: Security information and event management (SIEM) system

SIEM is for log aggregation and analysis, not inline blocking.

A
Next-generation firewall with application control
Why wrong: A firewall typically works at layers 3-4 and may not inspect application-layer anomalies effectively.
B
Web application firewall (WAF)
Why wrong: WAF only protects web applications.
C
Security information and event management (SIEM) system
Why wrong: SIEM is for log aggregation and analysis, not inline blocking.
D
Network-based IDS/IPS
IDS/IPS combined provides detection and prevention for known signatures and anomalies.

Question 13hardmultiple choice

A security engineer needs to design a solution to detect and respond to insider threats involving unauthorized data exfiltration via USB devices. Which of the following is the MOST effective approach?

Trap 1: Conduct regular security awareness training on data handling…

Training is important but does not provide technical enforcement.

Trap 2: Deploy endpoint detection and response (EDR) agents on all…

EDR is reactive and may not prevent exfiltration.

Trap 3: Disable all USB ports via group policy.

Disabling USB ports entirely may hinder legitimate business needs.

A
Conduct regular security awareness training on data handling policies.
Why wrong: Training is important but does not provide technical enforcement.
B
Deploy endpoint detection and response (EDR) agents on all workstations.
Why wrong: EDR is reactive and may not prevent exfiltration.
C
Disable all USB ports via group policy.
Why wrong: Disabling USB ports entirely may hinder legitimate business needs.
D
Implement a data loss prevention (DLP) solution with device control and content inspection.
DLP can block, log, and alert on unauthorized USB transfers.

Question 14mediummulti select

A security analyst is investigating a potential data breach. The logs show that an attacker used a compromised service account to access sensitive files on a file server. Which TWO actions should the analyst take FIRST to contain the incident? (Choose TWO.)

Trap 1: Check the workstation logs for signs of malware.

Checking endpoint logs is part of investigation, not immediate containment.

Trap 2: Notify law enforcement and the organization's legal department.

Notification is typically done after containment and legal review.

Trap 3: Restore the affected files from a known good backup.

Restoring is a recovery step, not containment.

A
Check the workstation logs for signs of malware.
Why wrong: Checking endpoint logs is part of investigation, not immediate containment.
B
Notify law enforcement and the organization's legal department.
Why wrong: Notification is typically done after containment and legal review.
C
Reset the service account password and revoke any active tokens.
Immediately stops the attacker's access.
D
Review and modify permissions on the file server to limit the account's access.
Helps identify and prevent excessive privileges.
E
Restore the affected files from a known good backup.
Why wrong: Restoring is a recovery step, not containment.

Question 15hardmultiple choice

A large enterprise has deployed a security information and event management (SIEM) system that ingests logs from all critical servers, network devices, and endpoints. The SIEM is configured to correlate events and generate alerts for suspicious activities. Recently, the SOC team has been overwhelmed by a high volume of false positive alerts, particularly from the web server farm. The false positives are mainly triggered by legitimate web crawling and scanning activities from partners and internal tools. The SOC manager wants to reduce false positives without missing real threats. As the security architect, you are asked to recommend a solution. Which of the following is the BEST course of action?

Trap 1: Increase the event threshold for web server alerts to reduce…

May cause real attacks to be missed if they occur below the new threshold.

Trap 2: Disable logging of successful requests on the web servers to reduce…

Would remove visibility and is too drastic.

Trap 3: Tune the SIEM to use more aggressive deduplication and aggregation…

May weaken detection for other use cases.

A
Increase the event threshold for web server alerts to reduce sensitivity.
Why wrong: May cause real attacks to be missed if they occur below the new threshold.
B
Disable logging of successful requests on the web servers to reduce log volume.
Why wrong: Would remove visibility and is too drastic.
C
Tune the SIEM to use more aggressive deduplication and aggregation globally.
Why wrong: May weaken detection for other use cases.
D
Create allowlists for known legitimate sources (e.g., partner IP ranges, internal scanners) in the SIEM correlation rules.
Directly reduces false positives while maintaining detection for unknown sources.

Read the full VPN explanation →

Question 16mediummultiple choice

A small business runs its critical line-of-business application on a single Windows server located in a local data center. The server is accessed by employees remotely via RDP over a VPN. Recently, the server has been experiencing slow performance, and the administrator notices high CPU usage from a process named 'svchost.exe'. The administrator suspects malware but is not sure. The business has no security tools beyond Windows Defender. Management wants to minimize downtime and ensure the server is back to full operation as soon as possible. Which of the following is the BEST course of action for the administrator to take first?

Trap 1: Restore the server from the most recent backup taken before the…

May reintroduce the same malware if the backup is infected.

Trap 2: Install a third-party antivirus solution and perform a full system…

Could conflict with Defender and cause further issues.

Trap 3: Disconnect the server from the network immediately to contain any…

Stops the attack but does not clean the system and causes downtime.

A
Run a full offline scan using Microsoft Defender (Windows Defender Offline) from a bootable media.
Can detect and remove malware without affecting the running system, minimizing downtime.
B
Restore the server from the most recent backup taken before the performance issues started.
Why wrong: May reintroduce the same malware if the backup is infected.
C
Install a third-party antivirus solution and perform a full system scan.
Why wrong: Could conflict with Defender and cause further issues.
D
Disconnect the server from the network immediately to contain any potential threat.
Why wrong: Stops the attack but does not clean the system and causes downtime.

Question 17easymulti select

Which TWO of the following are key components of a successful incident response plan according to NIST SP 800-61?

Trap 1: Vulnerability scanning

Vulnerability scanning is a security assessment technique, not a phase of the incident response plan.

Trap 2: Patch management

Patch management is an ongoing maintenance process, not a phase of incident response.

Trap 3: User training

User training is part of preparation but is not a separate phase in the NIST incident response lifecycle.

A
Vulnerability scanning
Why wrong: Vulnerability scanning is a security assessment technique, not a phase of the incident response plan.
B
Preparation
Preparation is a foundational phase of the incident response lifecycle.
C
Patch management
Why wrong: Patch management is an ongoing maintenance process, not a phase of incident response.
D
User training
Why wrong: User training is part of preparation but is not a separate phase in the NIST incident response lifecycle.
E
Detection and Analysis
Detection and Analysis is a critical phase in the incident response lifecycle.

Question 18hardmultiple choice

Based on the exhibit, which type of attack is most likely occurring?

Exhibit

Refer to the exhibit.

Exhibit:
```
Jul 15 10:23:45 server1 authpriv: sudo: pam_unix(sudo:auth): authentication failure; logname= uid=0 euid=0 tty=/dev/pts/2 ruser=root rhost=  user=admin
Jul 15 10:23:47 server1 authpriv: sudo: pam_unix(sudo:auth): authentication failure; logname= uid=0 euid=0 tty=/dev/pts/2 ruser=root rhost=  user=root
Jul 15 10:23:49 server1 authpriv: sudo: pam_unix(sudo:auth): authentication failure; logname= uid=0 euid=0 tty=/dev/pts/2 ruser=root rhost=  user=root
Jul 15 10:23:51 server1 authpriv: sudo: pam_unix(sudo:auth): authentication failure; logname= uid=0 euid=0 tty=/dev/pts/2 ruser=root rhost=  user=root
Jul 15 10:23:53 server1 authpriv: sudo: pam_unix(sudo:auth): authentication failure; logname= uid=0 euid=0 tty=/dev/pts/2 ruser=root rhost=  user=root
Jul 15 10:23:55 server1 authpriv: sudo: pam_unix(sudo:auth): authentication failure; logname= uid=0 euid=0 tty=/dev/pts/2 ruser=root rhost=  user=root
Jul 15 10:23:57 server1 authpriv: sudo: pam_unix(sudo:auth): authentication failure; logname= uid=0 euid=0 tty=/dev/pts/2 ruser=root rhost=  user=root
Jul 15 10:24:00 server1 authpriv: sudo: pam_unix(sudo:auth): authentication failure; logname= uid=0 euid=0 tty=/dev/pts/2 ruser=root rhost=  user=root
```

Trap 1: Pass-the-hash attack

Pass-the-hash uses NTLM hashes, not sudo authentication failures.

Trap 2: Account lockout attack

Account lockout would show lockout messages, not repeated authentication failures.

Trap 3: Replay attack

Replay attacks involve capturing and retransmitting valid credentials, not repeated authentication failures.

A
Pass-the-hash attack
Why wrong: Pass-the-hash uses NTLM hashes, not sudo authentication failures.
B
Account lockout attack
Why wrong: Account lockout would show lockout messages, not repeated authentication failures.
C
Replay attack
Why wrong: Replay attacks involve capturing and retransmitting valid credentials, not repeated authentication failures.
D
Brute force password guessing
The rapid succession of authentication failures for the root user indicates an attempt to guess the password.

Question 19mediummultiple choice

A security analyst at a financial institution is investigating a potential data exfiltration incident. The organization uses a zero-trust network architecture with micro-segmentation. The analyst notices that a database server with sensitive customer financial data has been communicating with an external IP address (198.51.100.45) over port 443 during non-business hours. The database server is not supposed to initiate outbound connections; all outbound traffic is logged and blocked by default except for specific allowlisted IPs and ports. The analyst reviews the firewall logs and finds that the outbound connection to 198.51.100.45 was allowed because the source port was 443, which is an allowed port for inbound HTTPS traffic. The database server is not a web server and does not run any HTTPS services. Which of the following is the best course of action for the analyst to take first?

Trap 1: Immediately block the external IP address at the perimeter firewall

Blocking the IP may disrupt evidence collection and does not address potential internal compromise.

Trap 2: Disable the database server's network interface

This is too drastic and may cause business disruption without first confirming compromise.

Trap 3: Review the database server's recent application logs for any…

While useful, this step is secondary to determining if the server is actively compromised.

A
Immediately block the external IP address at the perimeter firewall
Why wrong: Blocking the IP may disrupt evidence collection and does not address potential internal compromise.
B
Disable the database server's network interface
Why wrong: This is too drastic and may cause business disruption without first confirming compromise.
C
Review the database server's recent application logs for any anomalies
Why wrong: While useful, this step is secondary to determining if the server is actively compromised.
D
Check the endpoint detection and response (EDR) logs on the database server for signs of malware or unauthorized processes
Checking EDR logs can quickly indicate whether the server is compromised, guiding further actions.

Question 20mediumdrag order