scenario questions

Which THREE of the following are benefits of using a SIEM integrated with Cloud native logs?

A SOC analyst is reviewing DNS logs and observes a workstation issuing hundreds of unique subdomain queries under the domain telemetry-sync[.]net, each returning an NXDOMAIN response within seconds. No matching HTTP traffic appears in the proxy logs. Which attack technique is most consistent with this pattern?

In a SIEM, what is the role of a 'Parser'?

Which THREE actions are part of the 'Recovery' phase?

A suspicious PowerShell script is found on an endpoint. Which tool would you use to perform volatile memory analysis to identify if the script injected malicious code?

A SOC manager at a financial services company is preparing an audit defense for a recent data breach. The auditor asks for documented proof of how the SOC's daily operational activities align with the organization's overall business objectives and risk appetite. Which component of a SOC governance framework should the manager present to satisfy this request?

A SIEM alert indicates multiple failed logins followed by a successful login from a new IP in Splunk Enterprise Security. As a first responder, which dashboard should you navigate to in order to verify the MITRE ATT&CK mapping of this behavior?

Which THREE tools are typically used for forensic memory analysis?

A SOC analyst is investigating a security incident in an AWS environment. The analyst needs to determine which AWS API calls were made by a specific IAM user over the past week. Which AWS service should the analyst use to retrieve this information?

A SOC team is reviewing Azure activity logs and notices a series of role assignments being created for a service principal. The assignments grant Owner permissions at the subscription scope. The team needs to identify the exact operation name and the caller's IP address to determine if this is malicious. Which Azure log should they query?

A system administrator reports high CPU usage on a server. Upon checking task manager, you find 'svchost.exe' running from a temp folder. What is the most immediate action?

A SOC analyst notices that a critical Linux authentication server is generating an overwhelming volume of SSH failure logs, filling the SIEM's ingestion pipeline and causing delays in alert processing. To reduce noise while preserving forensic value for security investigations, which approach best balances log volume reduction with retaining necessary security context in the SIEM?

A SOC analyst is tasked with improving the incident response process. The analyst proposes several changes to the current workflow. Which TWO changes would most directly enhance the efficiency of incident handling? (Choose two.)

You are designing a SOC layout to foster collaboration. Which two team members should be seated in close proximity to share real-time intelligence?

Which THREE techniques are commonly used by SOC teams to improve alert quality and reduce fatigue?

You are managing a containment procedure for an external C2 callback. Which firewall rule configuration is most effective for immediate containment?

A SOC analyst is investigating a suspected data exfiltration incident. Network logs show large outbound transfers to an unfamiliar IP address over HTTPS. The analyst wants to determine if the traffic is malicious command and control (C2) or legitimate business traffic. Which technique should the analyst use to inspect the encrypted payload without terminating the session?

You are investigating a SIEM alert and identify a false positive caused by a system administrator's legitimate activity. How should you document this?

During triage of a SIEM alert indicating multiple failed VPN authentications followed by a successful login for the same account within five minutes, the analyst must classify the event. Which classification is MOST appropriate at this stage?

A SOC analyst is investigating a potential insider threat. The SIEM generated an alert for unusual file access on a file server by a user who normally works in a different department. The analyst needs to gather more context. Which of the following is the MOST appropriate action to take?

You are configuring a syslog-ng server to receive logs from multiple network devices. To ensure that logs from different departments are stored in separate directories based on the hostname, which directive should you utilize in the destination path?

You are configuring a SIEM and need to import a list of malicious IPs. What is the correct feature to use?

During malware analysis, an analyst observes that a suspicious executable's Import Address Table contains only a handful of imports, yet the binary clearly performs file encryption and outbound network communication at runtime. The analyst suspects the imports are resolved dynamically. Which technique should the analyst use to recover the API names the sample resolves at runtime?

A SOC analyst receives a Microsoft Defender for Endpoint alert indicating a suspicious PowerShell script executed on a finance workstation. The script attempted to download a file from an external IP. The alert severity is 'High'. According to the incident detection and triage process, what should the analyst do FIRST?

A SOC analyst reviews network telemetry and finds that an internal workstation is sending periodic DNS queries for randomly generated subdomains under a single parent domain, and each query receives an immediate NXDOMAIN response. The queries occur roughly every 30 seconds with high entropy in the leftmost label. There is no corresponding HTTP or TLS traffic to those hostnames. Which attack activity is MOST consistent with this pattern?

You notice an anomaly in your DNS traffic. Which type of DNS record is commonly associated with DNS tunneling for command and control?

A SOC analyst has acquired a forensic image of a compromised Windows host. To establish a defensible timeline of attacker activity, the analyst needs to place file system timestamps into a consistent, sortable sequence. Which step is essential before correlating timestamps across artifacts?

Which THREE components are essential to include in a SOC Incident Response plan?

A SOC analyst is building a proactive threat detection rule to identify DNS tunneling. Which characteristic of DNS traffic is most indicative of potential DNS tunneling activity?

You are writing a SIEM query to detect unauthorized access. The query is too slow. What can you do to optimize it?

What is the primary goal of the 'Eradication' phase in incident response?

A SOC analyst is investigating suspicious activity in a Google Cloud environment where a service account may have been compromised. The analyst needs to identify evidence of unauthorized use of that service account. (Choose two.)

During incident triage, you realize an alert is a False Positive. What is the most appropriate action to take within the SIEM ticketing system?

Which TWO factors are most critical when calculating the ROI of a SOC?

During an incident response engagement, a SOC analyst needs to acquire volatile memory from a running Windows 10 endpoint before isolating it from the network. The analyst must ensure the memory image is forensically sound and preserves the order of volatility. Which of the following should the analyst do FIRST?

You are analyzing a packet capture (PCAP) and find a beaconing pattern with a consistent 30-second interval and jitter of 5%. Which detection strategy is most effective for this IoC?

An analyst is reviewing a packet capture and observes periodic, fixed-interval HTTPS sessions from an internal host to a single external IP, each transferring roughly the same small number of bytes. The destination has no reputation data, and the certificate is self-signed. Which IOC category and interpretation best fits this observation?

A SOC analyst is triaging a SIEM alert for a possible data exfiltration. The alert triggered because a large volume of data (5 GB) was transferred from an internal database server to an external IP address over the past hour. The analyst checks the database server's logs and sees that the transfer was initiated by a scheduled backup job that normally runs at 2 AM, but it is currently 10 AM. The backup job uses a service account that has access to the database. Which of the following is the MOST likely explanation for this alert?

Which THREE of the following are common attributes used to prioritize security alerts during the triage process?

A SOC analyst is performing static analysis on a suspicious Windows Portable Executable (PE) file. The analyst wants to quickly determine the compile timestamp of the binary to assess whether it matches the reported incident timeline. Which field in the PE header should the analyst examine?

Which TWO steps are part of the 'Preparation' phase of the incident response process?

A SOC analyst is investigating a suspected compromise of an AWS Lambda function. The analyst needs to determine what code was executed and which IAM role the function assumed during the suspicious activity. Which AWS service should the analyst use to review the function's configuration and execution role?

During a suspected malware incident, a SOC analyst needs to isolate an infected workstation using Microsoft Defender for Endpoint. Which specific action should the analyst select within the Device inventory dashboard?

A SOC analyst is building detection logic for the Execution phase of an intrusion. The team wants to identify host artifacts that reliably indicate a process was launched with malicious intent. Which TWO of the following are the most appropriate host-based artifacts to monitor for this purpose? (Choose two.)

What is the primary benefit of using a centralized logging server compared to local logging?

What is the primary purpose of a 'War Room' during a major incident?

You are investigating an incident involving a malicious macro embedded in an Excel document. Which Windows process is typically the 'parent' of the malicious payload execution?

A SOC analyst is examining a memory dump from a compromised Windows host to identify injected code. Which TWO artifacts in the memory image most directly indicate process injection by malware? (Choose two.)

A SOC analyst is correlating EDR process-creation events with Windows Security logs during an investigation of an intrusion. The analyst notices that on a domain controller, the account 'svc_backup' authenticated successfully at 02:14, and two minutes later a new service named 'WinDefendHelper' was created, whose binary path points to C:\Windows\Temp\svc.exe. The service account configured for this service is the local SYSTEM account. Which attack technique is MOST consistent with this sequence?

Which THREE challenges are commonly associated with centralized log management in a large-scale enterprise?

A SOC analyst is conducting dynamic malware analysis on a suspicious binary in an isolated sandbox. The analyst observes that the malware creates a new file in the Startup folder and modifies a Run key in the registry. Which TWO artifacts should the analyst collect to document the persistence mechanisms for the forensic report? (Choose two.)

A SOC analyst is reviewing a phishing alert where the user reported an email with a malicious attachment. The analyst confirms the attachment's hash matches a known malware family in the threat intelligence platform. The user states they did not open the attachment. What is the MOST appropriate triage outcome?

A SOC analyst is investigating a security incident in Microsoft Azure where an attacker may have used a compromised service principal to access resources. The analyst needs to review sign-in activity for the service principal and identify any conditional access policy evaluations. Which Azure log should the analyst query to obtain this information?

A SOC analyst is reviewing Apache access logs and needs to extract only the client IP addresses and requested URLs for a threat-hunting query. The log format is the default combined format. Which approach should the analyst use to reliably parse these fields?

A SOC analyst receives an alert for suspicious PowerShell execution on a workstation. During triage, the analyst observes the command line: `powershell.exe -nop -w hidden -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAA...`. The endpoint's EDR shows the parent process as `winword.exe`. Which of the following BEST describes the immediate triage priority?

An organization uses the Diamond Model for threat intelligence. Which component of the model should an analyst prioritize to identify the infrastructure an adversary uses to communicate with compromised internal hosts?

An analyst receives an alert for 'Possible SQL Injection'. The payload contains harmless strings. How should the analyst proceed?

What is the main objective of the 'Post-Incident Activity' phase?

When designing correlation rules for an organization, which TWO of the following practices are recommended to minimize false positives?

A SOC team is building detection rules for cloud infrastructure. They want to identify potentially malicious activities in AWS that could indicate an account compromise. Which TWO of the following AWS API calls should be monitored as high-priority indicators of compromise? (Choose two.)

Which activity is a primary responsibility of a Threat Intelligence analyst within the SOC?

During an incident, a SOC analyst needs to preserve volatile evidence from a compromised Linux server before the incident response team arrives. The server is still running and the attacker may still be active. Which action should the analyst take first to capture the most volatile data?

A SOC analyst is proactively hunting for evidence of Pass-the-Hash lateral movement in a Windows environment. The analyst has access to endpoint telemetry and wants to identify the specific authentication behavior that distinguishes Pass-the-Hash from legitimate NTLM authentication. Which indicator should the analyst prioritize?

A SOC analyst is reviewing proxy logs and notices a series of HTTP POST requests to 'update.accounts-check.com' with large, encoded payloads occurring outside business hours. The domain was registered two days ago and has a low reputation. Which type of attack activity is most likely occurring?

A SOC analyst is investigating a suspected malware outbreak and needs to identify host-based indicators of compromise (IoCs) that would support the hypothesis of a compromised endpoint. Which TWO of the following are host-based IoCs that should be prioritized for collection and analysis? (Choose two.)

A SOC analyst is investigating a suspected credential-dumping incident on a Windows workstation. The analyst has EDR telemetry, Windows Security event logs, and memory capture available. Which TWO artifacts would MOST reliably confirm that credential material was accessed from LSASS memory? (Choose two.)

A SOC analyst is reviewing alerts in Microsoft Sentinel. They want to filter the 'SecurityAlert' table to only show alerts with a 'High' severity that originated from a specific resource provider. Which KQL operator should be used?

A SOC analyst is reviewing a packet capture from a suspected compromised host. The analyst observes a series of DNS queries for long, random-looking subdomains of a single domain, followed by TXT record responses containing encoded data. Which type of attack is most likely occurring?

A SOC analyst is tuning IDS signatures to reduce false positives while maintaining visibility. Which approach best balances detection efficacy with analyst workload?

When tuning a correlation rule in IBM QRadar, what is the role of the 'Building Block'?

A SOC analyst is triaging a potential phishing incident. An employee reported a suspicious email with an attachment. The analyst has retrieved the email and attachment. Which TWO of the following actions are MOST appropriate during the initial triage to determine if the attachment is malicious? (Choose two.)

Which document is essential for recording every action taken during an incident for legal and audit purposes?

Which TWO methods are commonly used to achieve log normalization in a modern SIEM?

You are remediating a compromised web server. After identifying the web shell, what is the next step to prevent further access?

You are investigating a data exfiltration incident. Which protocol's logs would most likely show large volumes of data being moved to a cloud storage provider?

A ticket is assigned to you with high priority. What is the first thing you should do?

Which THREE of the following represent 'Contextual Data' that can enrich a SIEM alert?

During malware analysis, a SOC analyst observes that a suspicious executable creates a new file in %TEMP% with a random name, then that file spawns a child process. The analyst wants to determine the exact parent-child process lineage and capture the command line used at launch. Which Windows artifact or tool provides this directly?

Which component of a SIEM is responsible for identifying patterns in real-time?

Which THREE of the following factors should be considered when designing a new SIEM use case?

You are tracking a threat actor who uses 'Living off the Land' (LotL) techniques. Which of the following commands is a classic indicator of this methodology?

A SOC analyst is reviewing logs from a cloud environment and needs to determine if an Amazon S3 bucket was made publicly accessible. The analyst wants to identify the specific API call that changed the bucket's access control list (ACL). Which AWS service should the analyst check?

When performing static analysis of a malicious binary, which THREE indicators should an analyst typically look for?

You are performing alert triage on a potential data exfiltration attempt. The SIEM shows 50GB of data transferred to a known cloud storage IP address. What is the most important next step in your triage process?

Which Azure feature allows you to automatically enforce security settings on your resources to prevent unauthorized changes?

Which of the following is a key advantage of utilizing a centralized SIEM platform?

During an incident involving a Windows workstation that exhibits beaconing to an external IP every 60 seconds, you need to preserve volatile evidence before the machine is rebooted. Which of the following should you capture FIRST according to order of volatility?

An organization is implementing a proactive detection strategy using the MITRE ATT&CK framework. Which phase of the implementation should the SOC prioritize to maximize detection coverage against common enterprise threats?

A SOC is designing a log management pipeline to ingest Windows Event Logs, Syslog from network devices, and application logs into a SIEM. The team needs to ensure that timestamps are consistent across all sources for accurate correlation. Which TWO practices are most effective for achieving time synchronization and accurate event ordering? (Choose two.)

A security analyst needs to ensure that sensitive log data is protected during transmission between a remote web server and the central SIEM. Which mechanism provides the highest level of security?

A SOC analyst receives a suspicious PDF attachment from a user. The analyst wants to quickly determine whether the PDF contains JavaScript or an embedded executable without executing it. Which approach is most appropriate?

A user complains that their browser homepage has changed. Upon inspection, you find a new, unsigned extension installed. Which attack methodology is this?

In the context of malware analysis, which TWO of the following are primary differences between static and dynamic analysis?

What is a 'log source' in the context of a SIEM?

An analyst notices that a workstation's registry Run key now points to a binary located in the user's AppData\Roaming directory, and the binary is unsigned and has no version information. The change occurred shortly after the user opened an email attachment. Which attacker objective does this artifact most directly support?

When an analyst suspects that a malicious user is using a VPN to hide their source IP, which technique is most helpful for attribution?

A SOC analyst is reviewing logs from a web server and notices repeated requests with URLs containing encoded characters like %27 and %20. The analyst suspects a SQL injection attempt. Which log source should the analyst examine to correlate the source IP and the full request, including headers?

You are a SOC analyst monitoring the SIEM dashboard. An alert triggers for multiple failed login attempts from a single external IP address targeting several user accounts. According to the incident response lifecycle, which phase does this activity represent?

What does the 'False Positive' rate of a SIEM rule indicate?

Which THREE of the following are characteristics of 'Advanced Persistent Threat' (APT) attack methodologies?

A SOC analyst is reviewing Microsoft 365 audit logs after a user reported a suspicious email. The analyst wants to determine whether the email was delivered to the user's mailbox and whether the user interacted with a malicious URL in the message. Which Microsoft 365 tool should the analyst use to trace message delivery and inspect URL click events?

A SOC manager is evaluating the log retention strategy for a new SIEM deployment. Regulatory requirements mandate that all authentication logs be retained for at least one year and be available for immediate search. Which storage tier strategy best meets both the retention and accessibility requirements while optimizing cost?

While investigating a potential malware infection, a SOC analyst needs to determine if a specific binary has been analyzed by the security community before. Which platform is the industry standard for checking the reputation of a file hash across dozens of antivirus engines?

A SOC team uses AWS Security Hub to centralize findings from GuardDuty, Inspector, and Macie. The team wants to automatically route only high-severity findings to an incident response ticketing system while suppressing informational findings. Which AWS Security Hub capability should the team configure to accomplish this?

A SOC analyst is following the organization's incident response plan and has just completed containment of a malware outbreak. According to the NIST SP 800-61 lifecycle, which phase should the analyst perform next?

While using ServiceNow Security Incident Response (SIR), you need to escalate a ticket. What is the standard process to ensure the security manager receives notification?

A SOC manager is documenting the team's escalation workflow. During a high-severity incident, the Tier 1 analyst must notify the Tier 2 analyst who then engages the Incident Response lead. The manager wants to formally define the sequence of notifications and responsibilities. Which document should the manager update?

You are managing a SIEM and notice a massive spike in 'false positive' alerts originating from a legacy vulnerability scanner. What is the best practice for tuning these alerts without losing visibility into the scanner's activity?

A SOC analyst is reviewing a suspicious email reported by a user. The email contains a link to a seemingly legitimate website, but the analyst suspects a phishing attempt. Which action should the analyst take to safely analyze the URL without compromising the corporate network?

Which TWO log types are considered critical for forensic analysis after a network intrusion?

A SOC analyst is examining a Windows 10 workstation suspected of malware infection. During live response, the analyst needs to capture the current state of network connections, associated process IDs, and executable paths to identify potential command-and-control communication. Which native Windows command should the analyst run to obtain this information?

A SOC analyst is investigating a suspected data exfiltration incident. The SIEM shows a large outbound transfer from an internal server to an external IP, but the firewall logs indicate the connection was allowed. The analyst needs to determine if the transfer was authorized by reviewing application logs. Which log source should the analyst prioritize to identify the user or process that initiated the transfer?

You are investigating a SIEM alert in Splunk that indicates a potential data exfiltration. The alert uses a threshold of 500MB. How can you improve the accuracy of this alert?

Which TWO methods are commonly used to achieve persistence on a Windows host?

A SOC analyst is triaging an alert from a Windows server indicating a new service was installed. The service binary is located in `C:\Windows\Temp\svc.exe` and runs as `LocalSystem`. The analyst checks the service creation time and sees it was created 10 minutes ago. The server's change management system shows no approved changes. Which of the following is the MOST likely explanation?

You are performing triage for an alert involving unauthorized access to an S3 bucket. Which service would you consult to review the API calls made to that bucket?

A SOC analyst receives an alert from the SIEM indicating a potential brute-force attack against a domain controller. The alert shows 20 failed logon attempts (Event ID 4625) for the user 'administrator' within 30 seconds, followed by a successful logon (Event ID 4624) from the same source IP. The analyst wants to determine if this is a true positive and prioritize the response. According to incident triage best practices, what is the MOST appropriate next step?

A SOC analyst is performing a proactive threat hunt for data exfiltration over DNS. The environment uses a corporate DNS resolver at 10.10.10.53. Which data source should the analyst query FIRST to identify high-volume, anomalous DNS TXT queries to external domains?

You are configuring a correlation rule in Splunk Enterprise Security. An analyst reports that too many false positives are triggered for 'Multiple Failed Login Attempts'. What is the most effective way to tune this rule?

A SOC analyst is reviewing logs from a web server and notices that the logs contain entries with timestamps in the format '2025-04-01T14:23:45+02:00'. The SIEM is configured to display all events in UTC. What is the correct UTC time for this log entry?

Which TWO indicators should an analyst watch for in a potential phishing campaign?

What is the purpose of 'Dashboards' in a SIEM?

A SOC analyst is investigating a potential compromise in an AWS environment. The analyst suspects that an attacker used a set of temporary credentials obtained from an EC2 instance metadata service. Which AWS service should the analyst review to determine which IAM role was assumed and what actions were taken with those credentials?

During an incident response, you identify a persistent malware process. You need to see exactly which files and registry keys the process is touching in real-time. Which Sysinternals tool provides this capability?

An analyst is investigating an alert regarding an outbound connection to a known malicious IP. Which step should be taken first according to standard triage procedures?

A SOC analyst is analyzing a suspected PowerShell-based attack. Which Windows log event ID is primarily used to log executed PowerShell command blocks?

A SOC analyst is using GCP and sees an alert regarding 'exfiltration of data' from a Cloud Storage bucket. Which tool should be analyzed to identify the specific file names accessed during the event?

Which THREE items should be included in a standard incident containment report?

A SOC analyst is building a proactive detection for Kerberoasting in an Active Directory environment. The analyst wants to alert on the specific event that indicates a service ticket was requested with weak RC4 encryption for an account with a Service Principal Name. Which Windows security event ID and field combination should be used?

Which THREE of the following are essential for effective incident response within a SIEM?

A SOC analyst is responding to a confirmed ransomware incident on a file server. The analyst must preserve evidence for potential legal action while also containing the threat. Which TWO actions should the analyst perform to maintain forensic soundness during containment? (Choose two.)

Which of the following is considered a 'Network-based' IoC?

Which THREE factors should be considered when determining the severity level of an incident?

During a phishing investigation, you receive a suspicious link. Which safety measure should you use to analyze the link?

You are managing log rotation on a Linux-based log aggregator. Which configuration file is used by the logrotate utility to define the retention and compression settings for log files?

Your organization is evaluating its SOC maturity using the CMMI-based model. If the SOC has documented standard processes but lacks consistent automation, which maturity level has been achieved?

An analyst is tasked with monitoring for 'Living off the Land' (LotL) attacks. Which of the following built-in Windows utilities, if used by a non-administrative user, warrants immediate investigation?

Which of the following is an example of an 'Indicator of Compromise' (IoC)?

A SOC analyst is conducting memory forensics on a compromised Windows host using Volatility 3. The analyst needs to identify malicious processes that may be hiding using rootkit techniques. Which two Volatility 3 plugins should the analyst use to detect hidden or unlinked processes? (Choose two.)

A SOC analyst is investigating a suspected compromised user account. The analyst observes that the account was used to access a critical file server at 3:00 AM, outside of normal business hours, from an IP address geolocated in a foreign country. The account owner is currently on vacation in that country. Which factor is MOST important to consider when determining if this is a true positive?

A threat hunter observes that an internal host is sending periodic HTTPS beacons to a rare external IP address at consistent 60-second intervals, with identical packet sizes and no corresponding user browsing activity. The TLS certificate on the destination is self-signed and the JA3 fingerprint does not match any known browser. Which phase of the Cyber Kill Chain does this activity most directly represent?

You are configuring AWS GuardDuty to improve threat detection. You need to ensure it monitors for unusual S3 bucket access. Which data source must be enabled for this?

A SOC analyst is reviewing a security incident that involved a compromised user account. The analyst needs to determine the scope of the compromise by identifying all systems the attacker accessed. Which of the following is the most effective method to achieve this?

What is the purpose of a 'Lookback Window' in a SIEM correlation rule?

A SOC analyst is triaging a SIEM alert for a possible insider threat. The alert indicates that a user accessed a file share containing sensitive financial data outside of normal business hours. The analyst needs to gather additional context to determine if this is malicious. Which TWO of the following actions should the analyst perform to enrich the alert? (Choose two.)

You are designing a rule in a SIEM to detect brute force attacks. What is the most important factor when choosing the time window for the rule?

You are auditing your SOC workflow and find that incident escalations are delayed. Which metric should you analyze to identify the bottleneck between alert detection and analyst assignment?

A SOC analyst is investigating a suspected data exfiltration incident. The SIEM shows a large outbound data transfer from an internal server to an unknown external IP address. To determine if this is a true positive, the analyst needs to correlate user activity with the network event. Which data source would provide the MOST direct evidence of the user or process responsible for the transfer?

Which TWO types of evidence are classified as 'volatile' and should be captured first during a forensic investigation?

Which TWO of the following are primary goals of the 'Command and Control' (C2) phase?

Which TWO types of logs are most useful for detecting lateral movement?

A SOC analyst is configuring network monitoring to detect beaconing behavior from a compromised host. Which network traffic characteristic is the most reliable indicator of C2 beaconing?

You are investigating an unauthorized login to an AWS IAM role. You need to determine the specific API call that was made and the source IP address. Which AWS service should you query?

In the context of proactive detection, which TWO of the following are effective methods for identifying 'Low and Slow' exfiltration attempts?

A SOC analyst in a Microsoft 365 E5 organization is investigating a phishing campaign that successfully compromised a user account. The analyst needs to determine whether the attacker created a mailbox rule that silently forwards incoming mail to an external address. Which Microsoft 365 security feature should the analyst query to retrieve this evidence?

Which THREE items are essential components of a robust log management policy?

Which TWO of the following are valid reasons for an analyst to escalate a SIEM incident?

A SOC analyst is building a proactive detection for Kerberoasting in an Active Directory environment. The SIEM ingests Windows Security event logs. Which event ID and condition should the analyst alert on to detect a Kerberoasting attempt?

A SOC manager is reviewing the team's performance and notices that the mean time to detect (MTTD) incidents has increased over the past quarter. Which of the following is the most likely cause for this increase?

When conducting a forensic investigation, you need to ensure the integrity of the collected digital evidence. What is the most critical step to perform immediately after copying the original media to a forensic workstation?

A SOC analyst is reviewing a threat intelligence report that includes indicators of compromise. The analyst wants to proactively use these IOCs to detect future attacks. Which action best leverages the IOCs for detection?

A SOC analyst is proactively hunting for DNS tunneling activity. The organization's DNS logs include query name, query type, source IP, and response size. Which combination of characteristics is most indicative of DNS tunneling?

A SOC analyst is proactively hunting for beaconing activity that indicates command-and-control (C2) communication. The analyst wants to identify network flows that show regular, periodic connections to external IPs. Which TWO data sources and analysis methods should the analyst use to detect this behavior? (Choose two.)

A SOC analyst is investigating a suspected ransomware incident on a Windows 10 endpoint. The user reported a pop-up demanding payment, and files have been renamed with a .locked extension. The analyst has isolated the endpoint from the network. Which artifact should the analyst examine FIRST to identify the ransomware variant and potential decryption tools?

Which THREE of the following are common steps during the 'Alert Triage' process?

A SOC analyst receives an alert that a workstation has an outbound connection to a known command-and-control IP address over TCP port 4444. The connection is long-lived and the process making it is 'rundll32.exe' with a command line referencing a DLL in the user's AppData folder. Which phase of the attack lifecycle does this activity MOST directly represent?

Which THREE factors should be considered when determining the log retention period in a SOC environment?

Which of these is a common SIEM data ingestion protocol?

Which TWO of the following are valid examples of 'Host-based' Indicators of Compromise?

A SOC analyst is triaging an alert from an endpoint detection and response (EDR) platform showing that 'rundll32.exe' loaded a DLL from the user's Downloads folder and then established an outbound connection to an unfamiliar IP on port 443. Which TWO actions should the analyst take FIRST to properly triage this alert? (Choose two.)

A SOC is implementing a 'Follow-the-Sun' model. What is the most critical requirement for this transition to be successful?

Which THREE of the following are commonly monitored artifacts for detecting 'Persistence' mechanisms?

A SOC analyst is triaging a phishing alert reported by a user. The email contains a link to a credential harvesting page. The analyst needs to determine the scope of the incident. Which TWO actions should the analyst perform to identify other users who may have received the same email? (Choose two.)

A SOC analyst must configure a Linux web server to forward its logs to a central syslog server over the network. The organization requires reliable delivery and wants to avoid losing messages if the central server is temporarily unreachable. Which TWO syslog configuration directives should the analyst use? (Choose two.)

When implementing a centralized logging architecture, which protocol is preferred for log transmission to ensure delivery confirmation between the collector and the aggregator?

A SOC analyst is performing dynamic analysis of a suspicious Windows binary in an isolated lab. The analyst wants to observe the sample's interaction with the file system, registry, and network in real time, and also capture the arguments passed to Windows API calls. Which monitoring approach best provides this combined visibility?

A SOC analyst is monitoring a Google Cloud environment and receives an alert about a potentially compromised service account. The analyst needs to investigate the extent of the compromise by examining audit logs. Which TWO log types should the analyst review to identify actions taken by the service account and any configuration changes made to it? (Choose two.)

While hunting for persistence mechanisms, you observe a suspicious scheduled task. Which detail in the task definition is the most critical indicator of a malicious actor rather than a legitimate software update?

A SOC analyst is reviewing EDR telemetry and observes that a user-level process named 'wscript.exe' spawned a child process 'powershell.exe' with the command line 'powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdAA...'. The parent process had been launched from an email attachment. Which attack technique is most strongly indicated by this chain of events?

You are performing a cloud-native incident response in AWS. You need to isolate a compromised EC2 instance without deleting the volume. What is the standard process?

A SOC analyst is integrating a new STIX/TAXII feed into a SIEM. Which configuration setting is mandatory to ensure the automated ingestion of threat indicators correctly maps to the internal incident response workflow?

During an incident, a SOC analyst needs to preserve volatile memory on a Windows Server 2019 host before shutting it down. The server is running critical services and cannot be taken offline immediately. Which action best preserves the most volatile evidence while minimizing disruption?

In the context of the MITRE ATT&CK framework, what is the primary goal of the 'Command and Control' tactic?

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

You are the SOC manager at a financial institution. During a monthly review, you notice that the mean time to detect (MTTD) security incidents has increased from 15 minutes to 3 hours over the past quarter. After investigation, you find that analysts are manually correlating alerts from the SIEM with threat intelligence feeds, which is time-consuming. Which action should you take FIRST to reduce MTTD?

A SOC analyst is monitoring an Azure environment and receives an alert about a suspicious sign-in from an unfamiliar location. The analyst wants to review the sign-in logs to see the applied conditional access policies and the risk level of the sign-in. Which Azure AD log should the analyst use?

When dealing with a ransomware incident, why should you prioritize disconnecting the host from the network over immediate rebooting?

A SOC manager is defining the tiered structure of the SOC. Which tier is primarily responsible for initial triage and basic incident filtering?

A security analyst is investigating suspicious activity in a Google Cloud environment. The analyst suspects that a service account key was used from an unauthorized location to access Cloud Storage buckets. The analyst needs to identify the source IP address and the specific API method called. Which GCP service should the analyst use?

A SOC analyst is triaging a security alert generated by the SIEM. The alert indicates that a workstation attempted to connect to a known malicious IP address on port 443. The analyst verifies that the workstation's user recently received a phishing email. Which of the following should the analyst do FIRST to contain the potential incident?

You are tasked with tuning a SIEM rule that is triggering on legitimate internal vulnerability scanners. What is the best course of action?

A SOC team is deploying a new log management system and needs to ingest logs from various sources, including Windows Event Logs, Linux syslog, and network device logs. The team wants to ensure that all logs are parsed into a common format for easier analysis. Which component of the ELK Stack is primarily responsible for parsing and transforming logs before they are stored in Elasticsearch?

A SOC analyst is proactively hunting for DNS tunneling used by malware to exfiltrate data from a compromised host. The SIEM has DNS query logs from all internal resolvers. Which detection query would most effectively surface potential DNS tunneling activity?

A SOC analyst is performing post-incident analysis after a successful containment of a malware outbreak. The analyst needs to identify which two Windows Registry locations are commonly used by malware for persistence to ensure they are cleaned. (Choose two.)

You are a SOC analyst investigating a potential data exfiltration incident. The SIEM has generated alerts for unusual outbound traffic to an unknown IP address. To determine if this is a true positive, you need to gather additional evidence. Which TWO actions should you perform? (Choose two.)

Which THREE actions should be taken after an indicator of compromise (IOC) is identified to ensure it is effectively used in a proactive detection program?

During an incident response, a SOC analyst examines a Windows host and finds that the 'Image Path Name' for a service named 'UpdaterSvc' points to 'C:\Windows\Temp\svc.exe'. The service is set to start automatically and runs as LocalSystem. The file 'svc.exe' is unsigned and has a creation timestamp from yesterday. Which persistence technique is most likely in use?

Which THREE factors contribute to 'dwell time' in a security incident?

A SOC manager is evaluating the team's performance and wants to measure how effectively they are using threat intelligence to prioritize alerts. Which metric best indicates the proportion of high-risk alerts that were correctly identified as true positives?

During a threat hunting exercise, an analyst discovers a suspicious PowerShell execution pattern using encoded commands. Which technique should the analyst employ next to determine if the activity is malicious or legitimate system administration?

Which TWO of the following are standard log types ingested into a SIEM?

When building a new SIEM use case, what is the first phase of the development lifecycle?

A SOC analyst is preparing to collect digital evidence from a compromised server. Which TWO actions must be documented to maintain a proper Chain of Custody?

A SOC analyst receives an alert about a suspicious process named 'svchost.exe' running from C:\Users\Public\Downloads. The analyst wants to quickly determine whether the process is malicious by examining its parent process, command line, and loaded modules. Which Sysinternals tool should the analyst use?

A SOC analyst is triaging a SIEM alert for a potential data exfiltration attempt. The alert shows a large outbound transfer to an unknown IP address from a database server. The analyst needs to determine if this is malicious or benign. Which of the following actions is MOST appropriate to perform FIRST?

A SOC analyst is investigating a suspected compromised host and wants to identify persistence mechanisms that survive reboots. The analyst runs the command 'schtasks /query /fo LIST /v' on the host. Which field in the output is most critical for determining if a scheduled task is malicious?

When analyzing network traffic associated with a malware C2 channel, you observe encrypted traffic. Which approach allows you to inspect the content of this traffic without the malware's private key?

You are defining log retention policies. According to general compliance standards like PCI-DSS, what is the primary requirement for log retention?

A SOC analyst is reviewing DNS logs and sees a host repeatedly querying subdomains like 'a1b2c3d4e5.evil-domain.com' every 60 seconds, with each subdomain being a random 10-character string. The responses are consistently NXDOMAIN. Which attack technique is most likely indicated?

A SOC analyst is implementing a proactive detection for suspicious PowerShell usage. The organization has Windows 10 endpoints with PowerShell v5.1 and Script Block Logging enabled. Which event ID should the analyst monitor to capture the actual script block content executed?

A SOC analyst receives a high-severity alert indicating that a workstation is communicating with a known command-and-control domain. Before escalating to the incident response team, the analyst wants to determine whether the alert represents a true positive and gather additional context. Which action best supports this triage decision while preserving forensic evidence?

Which TWO of the following are key components of a successful SIEM use case development process?

Which TWO actions should an analyst take when reviewing an alert that has been flagged as a 'False Positive' in the SIEM?

You receive an alert for 'Account Lockout'. You check the logs and see 10 failures in 1 second. What does this suggest?

Which TWO of the following are primary components of a SIEM architecture?

You are reviewing a SIEM alert and see a 'Successful login' from an unusual location. What is the next logical action?

A SOC analyst receives an alert about a possible data exfiltration attempt from a database server. The analyst needs to determine if large amounts of data were transferred outbound. Which network monitoring approach would best provide this information?

What is the primary function of an IOC (Indicator of Compromise) in an incident?

A SOC analyst is tasked with reducing 'alert fatigue' by categorizing alerts based on their MITRE ATT&CK technique mapping. Which phase of the incident response lifecycle is the analyst performing?

You suspect an attacker is using a specific user account to log in from multiple geographic locations simultaneously. Which SIEM capability allows you to detect this?

An analyst notices a spike in outbound traffic to a known sinkhole IP address. What does this indicate?

You are configuring an EDR tool to detect potential credential dumping. Which specific behavioral indicator is most effective at identifying an attacker attempting to access the LSASS process memory?

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to examine logs from a Cisco ASA firewall to identify outbound connections that may have transferred sensitive data. Which syslog severity level should the analyst configure on the ASA to capture connection-related events while minimizing log volume?

What is the primary goal of the 'Eradication' phase in the Incident Response lifecycle?

In IBM QRadar, you notice that a specific log source is not contributing to offense creation. Upon checking the 'Log Activity' tab, you see events are being parsed but are not mapped to any QID. What is the next logical step?

An organization has a SIEM and is struggling with 'alert fatigue.' What proactive measure should the SOC manager implement to improve the Signal-to-Noise ratio?

You are designing a correlation rule in an ArcSight ESM environment. You need to aggregate events based on a 'SessionID' field, but the 'SessionID' is not explicitly parsed in the incoming CEF logs. What must you do first?

You are configuring a SIEM alert threshold to reduce noise. Which metric should you adjust to ensure that only events occurring 5 times within a 60-second window trigger a high-severity alert?

Which TWO settings should you prioritize when configuring AWS CloudTrail for a robust security audit trail?

A SOC analyst receives an alert that a workstation's host-based sensor detected the process 'powershell.exe' spawning 'cmd.exe' which then spawned 'vssadmin.exe delete shadows /all /quiet'. The endpoint is still online and the user is actively logged in. According to the SOC incident handling process, what is the MOST appropriate next action?

What is the purpose of normalizing logs in a SIEM?

A SOC analyst is reviewing logs from a Linux server and notices that the /var/log/messages file is growing rapidly and consuming disk space. The analyst needs to ensure that logs are rotated daily and compressed, and that only the last 7 days of logs are retained. Which logrotate configuration directive should be used to achieve the retention requirement?

A SOC analyst is triaging a Linux web server that is suspected of hosting a web shell used by an attacker to maintain access. The analyst has a disk image and needs to identify indicators of the web shell and its activity. Which TWO artifacts should the analyst prioritize examining? (Choose two.)

You are performing static analysis on an suspicious executable. You want to view the imported functions, strings, and headers without executing the code. Which tool is most appropriate for this task?

During a forensic analysis, you find a 'shimcache' entry indicating an executable ran from a volume that no longer exists. What does this suggest?

During a forensic investigation of a compromised Windows server, an analyst discovers an alternate data stream (ADS) attached to a legitimate system file. The analyst wants to extract the hidden content for malware analysis. Which Windows command should the analyst use to view the contents of the ADS?

A SOC analyst is performing dynamic malware analysis in an isolated sandbox. The analyst wants to observe the malware's file system and Registry modifications in real time and then roll back the system to a clean state afterward. Which approach best supports this requirement?

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate outbound network connections with the processes that initiated them on a Windows 10 endpoint. Which log source should the analyst query to obtain this information?

A SOC analyst in a Splunk ES environment is triaging a notable event for a possible phishing campaign. The notable event aggregates multiple email security alerts and endpoint alerts. The analyst must determine which additional data sources to correlate to confirm and scope the incident. (Choose two.)

A SOC analyst receives an alert about a workstation making an outbound connection to a known malicious IP address on port 443. The connection is encrypted and occurs every 5 minutes with small, consistent packet sizes. Which phase of the Cyber Kill Chain does this activity most directly represent?

A SOC analyst notices a spike in alerts for the same Windows event ID 4625 (failed logon) across dozens of workstations, each showing a different username and originating from the same internal server. The server is not a domain controller and has no legitimate authentication role. What does this pattern MOST likely indicate?

Which THREE of the following are common indicators of a cloud account compromise that should be monitored in your SOC?

A SOC analyst is proactively hunting for unauthorized remote access tools. The analyst wants to identify hosts where a remote desktop client was used to connect to an external IP address. Which Windows artifact should the analyst examine to find the most recent outbound RDP connection targets?

In ArcSight, a correlation rule is failing to trigger despite matching event patterns. You verify the filter logic is correct. What is the most likely cause?

Which TWO pieces of information are critical to include in an initial incident ticket?

A SOC analyst is configuring an ELK Stack to ingest logs from multiple sources. The analyst notices that events from different time zones are being indexed with incorrect timestamps in Elasticsearch. Which action should the analyst take to ensure events are stored with a consistent, correct time reference?

Which TWO of the following are effective methods for reducing alert volume in a SIEM?

A SOC analyst is investigating an alert about a suspicious PowerShell execution on a Windows endpoint. The analyst wants to retrieve the full command line used in the PowerShell process from Windows event logs. Which Windows event log and event ID should the analyst examine?

You are a SOC analyst at a company that uses Microsoft 365. You receive an alert that a user's mailbox is being accessed from an unusual location. You need to review the mailbox audit logs to determine which operations were performed and by whom. Which Microsoft 365 tool should you use to search these logs?

You have captured a malicious binary and are performing dynamic analysis. You observe the malware attempting to resolve a domain that you want to intercept. Which tool allows you to simulate a DNS server response to redirect the malware traffic to a local analysis machine?

A SOC analyst is reviewing logs in a SIEM and notices multiple failed login attempts followed by a successful one from an unknown IP. Which specific IoC category does this activity represent?

A SOC analyst is documenting the incident response process for a new playbook. The playbook must specify the correct order of phases according to the NIST SP 800-61 incident response lifecycle. Which phase immediately follows 'Detection and Analysis'?

Which of the following describes 'Event Correlation' in a SIEM?

In the NIST Incident Response lifecycle, which phase involves the identification of the incident type and scope?

A SOC analyst notices that an AWS Lambda function's execution role was modified to include the AdministratorAccess managed policy. The change was made outside of any approved change window. The analyst needs to determine who made the modification and from which IP address. Which AWS service should the analyst query to retrieve this information?

You are reviewing a high-severity alert. Which information is critical to gather during the initial triage?

A SOC analyst is reviewing Windows Security event logs to detect brute-force attacks. The analyst filters for failed logon attempts but notices the events show Logon Type 3. Which logon type should the analyst focus on to identify interactive brute-force attempts against workstations?

Which TWO items are part of the 'Lessons Learned' process?

You are using an EDR to hunt for persistent scheduled tasks. Which artifact should you analyze to see tasks created within the last 24 hours?

You are designing a threat hunting hypothesis regarding an adversary using PowerShell for fileless execution. Which source of evidence provides the best visibility into the commands being executed?

You are triaging an alert in CrowdStrike Falcon. An endpoint shows a 'Suspicious File' detection. To verify the process tree and identify the parent process, which view do you use?

A SOC analyst is reviewing a SIEM alert that fired on a suspicious PowerShell execution. The command line includes an encoded parameter and a download cradle. The analyst confirms the endpoint is a developer workstation used for legitimate automation. Which action best balances security and business continuity while still validating the alert?

A SOC analyst receives a suspicious binary and wants to quickly compute its cryptographic hash to check against threat intelligence feeds before any execution. Which action should the analyst take?

You are configuring a SIEM alert and need to ensure it only triggers during business hours. Where is this configuration typically applied?

You are configuring a SIEM to integrate with an EDR tool. Which data field is most important for cross-platform correlation when tracking a single user's activity across the network?

A SOC analyst is reviewing a threat intelligence report that lists a new C2 domain. The SIEM has no prior detection rule for this domain. Which action best uses the diamond model to proactively operationalize this intelligence for future detection?

Which THREE of the following are common challenges in SIEM correlation rule development?

During a suspected lateral movement incident, you observe successful SMB sessions between two workstations. Which tool in Windows can be used to view these active sessions?

Which TWO actions should be taken when you find a rogue VM in your GCP environment?

Which document should you reference first to determine the communication path during a high-severity security incident?

You are reviewing a SIEM alert for a 'Brute Force Attack'. You notice the source IP is from a cloud provider. How should you classify this during triage?

A SOC analyst is preparing an incident response report for a confirmed phishing incident that led to credential theft. The analyst must document the timeline and impact. Which TWO artifacts should the analyst include to support the timeline and scope of the incident? (Choose two.)

An analyst is investigating a compromised system. Which THREE of the following artifacts are commonly checked for indicators of persistence?

When parsing unstructured logs into a structured format (JSON), which technique is most effective for mapping log fields to SIEM taxonomy?

In Azure, you suspect a compromised VM is being used for cryptocurrency mining. You want to see process-level execution details on that VM. Which tool should you use?

Which log management component is responsible for receiving log data from various network nodes and normalizing the format before storage?

Which SIEM feature is used to group related events into a single incident?

An analyst is reviewing logs in Splunk to investigate a potential exfiltration event. Which field should the analyst focus on to identify the volume of data sent to an external IP?

A SOC analyst receives an alert about a potential malware infection on a user's workstation. The analyst confirms the infection and needs to immediately prevent the malware from communicating with its command-and-control (C2) server. Which action should the analyst take first?

You are using a SIEM and notice that logs from a critical Windows server are missing. You verify the agent is running and the network is clear. What is the next step?

Which TWO metrics are essential for measuring the efficiency of an incident response team?

During triage of a suspected intrusion, a SOC analyst observes that a user account belonging to the finance department successfully authenticated from an IP address geolocated in a country where the company has no operations, at 03:00 local time. The account had no prior logins from that region. Which phase of the attack lifecycle does this most directly represent?

During an investigation, you need to perform a live acquisition of a suspect's system memory using FTK Imager. What is the correct order of operations to maintain integrity?

You are examining a suspicious file and suspect it is packed (obfuscated). Which technique or tool helps identify if a file is likely packed?

While analyzing an incident involving a malicious domain, you need to determine when the domain was registered. Which database should you query?

A SOC analyst is reviewing Windows event logs to proactively detect Kerberoasting activity. The environment uses Windows Server 2016 domain controllers and Windows 10 endpoints. Which event ID and field combination is most indicative of a Kerberoasting attempt?

You want to implement log integrity monitoring to ensure that logs are not tampered with after they are written. Which method is most robust?

During a suspected breach, you identify a rogue process running on a Linux server. Which command identifies the network socket associated with this process?

A SOC analyst receives a QRadar offense titled 'Multiple Failed Logins Followed by Success' for a domain service account. The offense lists 42 events from a single source IP over 3 minutes. Before escalating, the analyst must perform initial triage. Which action best represents the first step of triage for this offense?

Which role is responsible for the ongoing tuning of correlation rules and maintaining the SIEM health in a mature SOC?

A SOC manager is evaluating the effectiveness of the team's use of threat intelligence. The manager wants to ensure that threat intelligence is actionable and integrated into daily operations. Which TWO practices are essential for achieving this goal? (Choose two.)

A SOC analyst is investigating a suspected compromised Windows 10 workstation. The analyst wants to determine which removable USB storage devices were connected to the host and correlate that activity with a suspicious data exfiltration alert. Which artifact or registry location should the analyst examine FIRST to enumerate historically connected USB mass storage devices?

A SOC analyst is reviewing a critical alert on a database server that shows a sudden spike in outbound traffic to an unfamiliar IP address. The analyst suspects data exfiltration. According to the incident response lifecycle, which action should the analyst take FIRST?

Which THREE actions are appropriate during the eradication phase of a malware incident?

An organization is migrating to a cloud-native logging architecture using AWS CloudWatch. You need to forward logs from an on-premises server to CloudWatch. Which agent is the correct choice to facilitate this stream?

A SOC analyst is performing live forensic triage on a Windows Server 2019 host suspected of a credential-dumping attack. The analyst wants to identify whether the LSASS process memory has been accessed by an unauthorized tool in the last 24 hours. Which Windows event log source and event ID should the analyst review?

What is the primary function of a SIEM collector?

A SOC analyst is examining a suspicious executable and wants to determine if it has been packed, which would hinder static analysis. Which characteristic is the most reliable indicator that the file is packed?

You need to verify if an executable is malicious. Which site is most effective for checking the hash against multiple antivirus engines?

You are conducting a threat hunt for persistence. Which THREE locations in the Windows Registry should you include in your hunt as common targets for persistence?

A SOC analyst is triaging a Microsoft Defender for Endpoint alert on a workstation. The alert shows 'lsass.exe' was accessed by an unsigned process named 'rundll32.exe' launched from a user's temp folder. The analyst needs to determine the appropriate triage priority. Which factor should most strongly influence the priority of this alert?

A SOC analyst receives an alert from the SIEM showing a workstation repeatedly querying an algorithmically generated set of domain names, most of which resolve to NXDOMAIN, with a handful resolving to short-lived IP addresses. The analyst wants to map this behavior to the most likely stage of the Cyber Kill Chain and the corresponding IOC category. Which of the following best describes this activity?

When configuring log ingestion for a cloud service in a SIEM, you notice high latency in alert generation. What is the most likely cause?

A SOC is implementing a new use case to detect credential dumping on Windows endpoints. The detection engineering team wants to combine multiple telemetry sources to reduce false positives and improve coverage. Which two data sources should be prioritized to reliably detect credential dumping activity? (Choose two.)

During incident lifecycle management, your team needs to transition from 'Detection' to 'Containment'. What is the most critical action to perform first within your SOAR platform's playbook?

A SOC analyst is building a proactive detection rule to identify Kerberoasting activity in an Active Directory environment. Which TWO event characteristics should the rule alert on to maximize detection fidelity? (Choose two.)

A SOC analyst is auditing the environment for unauthorized lateral movement. Which TWO log sources are most critical for detecting remote access techniques like RDP or SMB exploitation?

Which TWO of the following are primary components of a cloud-native incident response plan?

When integrating threat intelligence into your SIEM, which THREE activities should be performed to ensure the data is actionable?

What is the primary benefit of 'Threat Intelligence' integration in a SIEM?

A SOC analyst is reviewing security alerts in an AWS environment and notices a finding that an S3 bucket has been configured with public read access. The analyst needs to identify the IAM principal that made the bucket public. Which AWS service should the analyst check to find the identity that performed the PutBucketAcl or PutBucketPolicy action?

A SOC analyst is triaging a suspected compromised Windows 10 workstation. The analyst needs to identify which network connections were established by a specific running process (PID 4212) at the time of investigation, without installing additional tools. Which built-in Windows utility should the analyst use?

A SOC analyst receives an alert that a domain controller is generating a high volume of Kerberos ticket-granting service (TGS) requests with RC4 encryption for various service principal names. The analyst suspects a Kerberoasting attack. Which Windows event ID should the analyst prioritize to confirm the attack?

A SOC analyst is reviewing authentication logs from a centralized syslog server. The organization requires that log entries include the original device hostname, but many entries show only IP addresses because the sending devices do not include a hostname in their syslog messages. Which syslog-ng configuration option should be used to resolve the IP address to a hostname before storing the logs?

Which of the following describes the 'Reconnaissance' phase in the Cyber Kill Chain?

You are managing security for GCP. You need to detect if a service account has been created with excessive permissions. Which Google Cloud tool provides this insight?

During an investigation of an incident, an analyst identifies a beaconing pattern in network logs. Which statistical analysis method is the most reliable for distinguishing this beaconing from normal, high-volume user traffic?

A SOC analyst is building detection content for credential access techniques on Windows endpoints. Which two artifacts would most reliably indicate an attempt to dump credentials from LSASS? (Choose two.)

A SOC analyst is triaging an alert from a network detection system indicating a possible internal port scan. The scan originated from a workstation and targeted multiple servers on TCP port 445. Before escalating, the analyst needs to determine whether this is malicious or benign. Which action provides the most relevant context for this decision?

You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?

Which THREE elements are essential in an incident notification email to senior management?

Which TWO of the following are considered indicators of a 'Data Exfiltration' attempt?

A SOC analyst in an AWS environment receives an alert that an EC2 instance is making unusual outbound DNS queries to a domain associated with command-and-control activity. The analyst needs to identify the full chain of API calls that led to the instance's current state, including any IAM role assumptions or network modifications. Which AWS service should the analyst use to retrieve this information?

Which AWS service is specifically designed to act as a centralized dashboard for finding security-related misconfigurations across your entire organization?

Which TWO of the following are considered best practices when configuring SIEM alerts to minimize false positives?

In Azure, you have detected a suspicious VM login. You need to investigate the sign-in patterns, including geographic location and device risk level. Where in the Azure portal should you look?

When performing alert triage in a SIEM, which metric is most important for prioritizing incidents based on the potential business impact?

A SOC analyst is investigating a potential data exfiltration incident. The analyst needs to correlate logs from multiple sources to identify the exfiltration channel. Which TWO log sources are most critical for determining the method and volume of data transferred out of the network? (Choose two.)