Scenario practice questions

Which SOC service model involves an organization outsourcing its security monitoring to a third-party provider while retaining internal control?

Trap 1: Virtual SOC

A Virtual SOC is an outsourced monitoring arrangement, but it does not inherently preserve the organisation's internal control over detection and response decisions. It is tempting because it involves a third-party provider, yet the retained-control element in the stem points to a co-managed or hybrid model instead.

Trap 2: Internal SOC

An Internal SOC keeps monitoring staffed and operated in-house, so nothing is outsourced to a third party. It is tempting because the organisation retains full control, which the stem mentions, but the outsourcing requirement is unmet; the correct model combines external monitoring with retained control.

Trap 3: Hybrid Cloud SOC

Hybrid Cloud SOC describes monitoring spanning on-premises and cloud infrastructure, not an outsourcing arrangement with retained internal control. It is tempting because it blends internal and external elements, but the axis of difference is deployment location, not who operates the monitoring service.

A
MSSP
A Managed Security Service Provider (MSSP) remotely delivers monitoring, detection and response as an outsourced service, while the client retains ownership of its security posture and policies. This satisfies the constraint of outsourcing monitoring yet keeping internal control.
B
Virtual SOC
Why it fails: A Virtual SOC is an outsourced monitoring arrangement, but it does not inherently preserve the organisation's internal control over detection and response decisions. It is tempting because it involves a third-party provider, yet the retained-control element in the stem points to a co-managed or hybrid model instead.
C
Internal SOC
Why it fails: An Internal SOC keeps monitoring staffed and operated in-house, so nothing is outsourced to a third party. It is tempting because the organisation retains full control, which the stem mentions, but the outsourcing requirement is unmet; the correct model combines external monitoring with retained control.
D
Hybrid Cloud SOC
Why it fails: Hybrid Cloud SOC describes monitoring spanning on-premises and cloud infrastructure, not an outsourcing arrangement with retained internal control. It is tempting because it blends internal and external elements, but the axis of difference is deployment location, not who operates the monitoring service.

Question 2hardmultiple choice

A SOC analyst is investigating a suspected data exfiltration incident. Network logs show large outbound transfers to an unfamiliar IP address over HTTPS. The analyst wants to determine if the traffic is malicious command and control (C2) or legitimate business traffic. Which technique should the analyst use to inspect the encrypted payload without terminating the session?

Trap 1: Use NetFlow records to analyze packet sizes and timings

NetFlow provides metadata about flows, such as byte counts and timestamps, but it does not inspect the encrypted payload. While anomalies in flow patterns can indicate exfiltration, they cannot distinguish between malicious and legitimate HTTPS traffic. Many legitimate applications also transfer large amounts of data. NetFlow alone is insufficient to confirm C2 activity without additional context.

Trap 2: Perform SSL/TLS interception using a proxy with a trusted…

SSL/TLS interception can decrypt traffic, but it requires installing a trusted certificate on the endpoint and may break the session if not properly configured. It also raises privacy concerns and might not be feasible for all traffic. In an incident response scenario, intercepting traffic in real-time could alert the attacker or disrupt operations. This technique is more suited for ongoing monitoring, not immediate investigation of an active incident.

Trap 3: Deploy a honeypot to capture similar traffic

A honeypot is a decoy system designed to attract attackers, but it cannot inspect existing encrypted traffic to an unfamiliar IP. It might provide information about attacker tools if they interact with it, but it does not help analyze the current session. Honeypots are proactive measures, not investigative tools for ongoing incidents. They would not provide insight into the specific encrypted payload in question.

A
Analyze the JA3/JA3S fingerprints of the TLS handshake
JA3 and JA3S are fingerprints derived from the TLS ClientHello and ServerHello packets. They can identify the client and server applications based on their TLS configuration, such as cipher suites and extensions. Malware often uses unique or default TLS libraries, resulting in distinct JA3 hashes. By comparing the fingerprint to known malicious or legitimate applications, the analyst can determine if the traffic is likely C2 without decrypting the payload. This method is passive and does not disrupt the session.
B
Use NetFlow records to analyze packet sizes and timings
Why it fails: NetFlow provides metadata about flows, such as byte counts and timestamps, but it does not inspect the encrypted payload. While anomalies in flow patterns can indicate exfiltration, they cannot distinguish between malicious and legitimate HTTPS traffic. Many legitimate applications also transfer large amounts of data. NetFlow alone is insufficient to confirm C2 activity without additional context.
C
Perform SSL/TLS interception using a proxy with a trusted certificate
Why it fails: SSL/TLS interception can decrypt traffic, but it requires installing a trusted certificate on the endpoint and may break the session if not properly configured. It also raises privacy concerns and might not be feasible for all traffic. In an incident response scenario, intercepting traffic in real-time could alert the attacker or disrupt operations. This technique is more suited for ongoing monitoring, not immediate investigation of an active incident.
D
Deploy a honeypot to capture similar traffic
Why it fails: A honeypot is a decoy system designed to attract attackers, but it cannot inspect existing encrypted traffic to an unfamiliar IP. It might provide information about attacker tools if they interact with it, but it does not help analyze the current session. Honeypots are proactive measures, not investigative tools for ongoing incidents. They would not provide insight into the specific encrypted payload in question.

Read the full DNS explanation →

Question 3mediummultiple choice

A SOC analyst in an AWS environment receives an alert that an EC2 instance is making unusual outbound DNS queries to a domain associated with command-and-control activity. The analyst needs to identify the full chain of API calls that led to the instance's current state, including any IAM role assumptions or network modifications. Which AWS service should the analyst use to retrieve this information?

Trap 1: AWS Config

AWS Config records resource configuration changes and can show the history of an EC2 instance's attributes, but it does not capture API calls that do not result in configuration changes, such as AssumeRole or certain network interface modifications. It lacks the granularity to trace the full chain of API calls leading to the instance's state.

Trap 2: Amazon VPC Flow Logs

VPC Flow Logs capture IP traffic metadata for network interfaces, which could show outbound DNS traffic, but they do not include API call details, IAM role assumptions, or resource modification events. They are useful for network-level analysis but cannot provide the API-level chain of actions required here.

Trap 3: Amazon GuardDuty

GuardDuty is a threat detection service that generates findings based on VPC Flow Logs, DNS logs, and CloudTrail. While it can alert on the suspicious DNS queries, it does not provide the detailed API call history or the ability to trace IAM role assumptions and network modifications. It is an alerting tool, not a forensic log repository.

A
AWS CloudTrail
CloudTrail records all API activity in the account, including RunInstances, ModifyNetworkInterfaceAttribute, and AssumeRole events. By correlating the instance ID with CloudTrail events, the analyst can reconstruct the sequence of API calls that created or modified the instance and its associated IAM role, providing the full chain of actions needed for incident response.
B
AWS Config
Why it fails: AWS Config records resource configuration changes and can show the history of an EC2 instance's attributes, but it does not capture API calls that do not result in configuration changes, such as AssumeRole or certain network interface modifications. It lacks the granularity to trace the full chain of API calls leading to the instance's state.
C
Amazon VPC Flow Logs
Why it fails: VPC Flow Logs capture IP traffic metadata for network interfaces, which could show outbound DNS traffic, but they do not include API call details, IAM role assumptions, or resource modification events. They are useful for network-level analysis but cannot provide the API-level chain of actions required here.
D
Amazon GuardDuty
Why it fails: GuardDuty is a threat detection service that generates findings based on VPC Flow Logs, DNS logs, and CloudTrail. While it can alert on the suspicious DNS queries, it does not provide the detailed API call history or the ability to trace IAM role assumptions and network modifications. It is an alerting tool, not a forensic log repository.

Question 4mediummultiple choice

You are designing a correlation rule in Microsoft Sentinel to detect lateral movement. You decide to use KQL to join 'SecurityEvent' and 'SigninLogs'. What is the primary benefit of using a join over a union in this scenario?

Trap 1: Unions only support structured data.

Unions handle structured and semi-structured data alike, so the claim is false. The real distinction is that a union appends rows into one result set, whereas a join correlates columns from both tables on matching keys — which is what lateral-movement detection across SecurityEvent and SigninLogs requires.

Trap 2: Joins consume less memory than unions.

Joins match rows across tables on a key, producing correlated pairs; unions stack rows with identical schemas. Memory consumption is not the axis of difference, and a join can actually require more working memory due to the hash build side. Joins are chosen for correlation, not for resource economy.

Trap 3: Unions cannot be used in detection rules.

Union does work in detection rules; it appends rows from both tables, which cannot correlate a sign-in with its matching security event. Join is chosen precisely when fields must be matched across tables to link related activity.

A
Unions only support structured data.
Why it fails: Unions handle structured and semi-structured data alike, so the claim is false. The real distinction is that a union appends rows into one result set, whereas a join correlates columns from both tables on matching keys — which is what lateral-movement detection across SecurityEvent and SigninLogs requires.
B
Joins allow matching records between two datasets based on a common field.
Joins correlate records across SecurityEvent and SigninLogs by matching a shared field, such as account or IP address, which is essential for linking authentication activity to endpoint events during lateral movement. A union merely stacks rows from both tables without relating them, so it cannot satisfy the requirement to correlate the two datasets.
C
Joins consume less memory than unions.
Why it fails: Joins match rows across tables on a key, producing correlated pairs; unions stack rows with identical schemas. Memory consumption is not the axis of difference, and a join can actually require more working memory due to the hash build side. Joins are chosen for correlation, not for resource economy.
D
Unions cannot be used in detection rules.
Why it fails: Union does work in detection rules; it appends rows from both tables, which cannot correlate a sign-in with its matching security event. Join is chosen precisely when fields must be matched across tables to link related activity.

Question 5mediummultiple choice

A SOC analyst receives an alert for suspicious PowerShell execution on a workstation. During triage, the analyst observes the command line: `powershell.exe -nop -w hidden -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAA...`. The endpoint's EDR shows the parent process as `winword.exe`. Which of the following BEST describes the immediate triage priority?

Trap 1: Run a full antivirus scan on the workstation to remove the…

A full antivirus scan is a remediation step, not an immediate triage priority. The malicious PowerShell process may still be running and could evade signature-based detection. Moreover, the scan takes time, during which the attacker could cause further damage. Isolation and containment are required before remediation to ensure the threat is fully neutralized and the environment is safe.

Trap 2: Decode the Base64 string to understand the payload, then decide…

While decoding the payload provides valuable intelligence, it is not the immediate priority. The active malicious process on a user endpoint poses an urgent risk. Delaying containment to analyze the payload could allow the attacker to escalate privileges, move laterally, or exfiltrate data. Containment should occur first to limit impact, followed by detailed analysis in a controlled manner.

Trap 3: Check the user's recent email activity to identify the source of…

Investigating the email source is part of the response, but it does not address the immediate threat on the compromised host. Blocking the sender may prevent further infections but does nothing to stop the current malicious process. The host must be isolated first to contain the active compromise, after which email analysis can be conducted to prevent recurrence.

A
Immediately isolate the workstation from the network and initiate the incident response process.
The combination of a hidden, encoded PowerShell command spawned by Microsoft Word is a strong indicator of a malicious macro-based infection, often leading to code execution and further compromise. Isolating the host is the priority to prevent lateral movement and data exfiltration. This aligns with containment best practices in incident response, as the threat is active and potentially spreading.
B
Run a full antivirus scan on the workstation to remove the malicious payload.
Why it fails: A full antivirus scan is a remediation step, not an immediate triage priority. The malicious PowerShell process may still be running and could evade signature-based detection. Moreover, the scan takes time, during which the attacker could cause further damage. Isolation and containment are required before remediation to ensure the threat is fully neutralized and the environment is safe.
C
Decode the Base64 string to understand the payload, then decide whether to isolate the host.
Why it fails: While decoding the payload provides valuable intelligence, it is not the immediate priority. The active malicious process on a user endpoint poses an urgent risk. Delaying containment to analyze the payload could allow the attacker to escalate privileges, move laterally, or exfiltrate data. Containment should occur first to limit impact, followed by detailed analysis in a controlled manner.
D
Check the user's recent email activity to identify the source of the document and then block the sender.
Why it fails: Investigating the email source is part of the response, but it does not address the immediate threat on the compromised host. Blocking the sender may prevent further infections but does nothing to stop the current malicious process. The host must be isolated first to contain the active compromise, after which email analysis can be conducted to prevent recurrence.

Question 6mediummultiple choice

A user complains that their browser homepage has changed. Upon inspection, you find a new, unsigned extension installed. Which attack methodology is this?

Trap 1: Man-in-the-Middle (MitM)

MitM intercepts or alters traffic between two parties in transit; it does not persist an unsigned extension on the endpoint or change homepage settings. It is tempting because MitM can inject content into unencrypted sessions, but that injection is transient. Here the malicious extension is installed locally, which is a different methodology.

Trap 2: Cross-Site Scripting (XSS)

XSS targets web application vulnerabilities.

Trap 3: SQL Injection

SQL Injection manipulates backend database queries through unsanitised input; it cannot install a browser extension or modify homepage configuration on a client. It is tempting because SQLi is a headline web attack and the scenario involves a browser, but the affected component is the endpoint, not a database.

A
Man-in-the-Middle (MitM)
Why it fails: MitM intercepts or alters traffic between two parties in transit; it does not persist an unsigned extension on the endpoint or change homepage settings. It is tempting because MitM can inject content into unencrypted sessions, but that injection is transient. Here the malicious extension is installed locally, which is a different methodology.
B
Cross-Site Scripting (XSS)
Why it fails: XSS targets web application vulnerabilities.
C
SQL Injection
Why it fails: SQL Injection manipulates backend database queries through unsanitised input; it cannot install a browser extension or modify homepage configuration on a client. It is tempting because SQLi is a headline web attack and the scenario involves a browser, but the affected component is the endpoint, not a database.
D
Browser Hijacking
Browser hijacking manipulates browser settings such as the homepage, search engine and new-tab page, typically through malicious or unsigned extensions installed without consent. The unsigned extension altering the homepage directly matches this methodology, satisfying the stem's evidence of unauthorised browser configuration changes rather than credential theft or code execution.