203 questions total · 3pages · All types, answers revealed
Which security framework is most commonly used by US federal agencies to manage security controls?
This is the standard for federal agencies.
Why this answer
NIST SP 800-53 is the mandatory security control catalog for US federal information systems.
You need to ensure that all endpoints in your organization have the 'CrowdStrike Falcon' agent running and are reporting correctly. Which dashboard should you use?
This is the specific dashboard for managing endpoint agents and their status.
Why this answer
The CrowdStrike 'Host Management' dashboard provides a real-time view of sensor status, version, and connectivity.
When using Wireshark to investigate a data exfiltration incident, you want to filter for TCP streams involving a specific internal IP that are larger than 1MB. How is this achieved?
This is the correct path for analyzing stream sizes in Wireshark.
Why this answer
Wireshark provides flow-level statistics via 'Statistics > Conversations > TCP', which allows for filtering and viewing stream sizes.
You are configuring a YARA rule for CrowdStrike Falcon to detect Cobalt Strike Beacon traffic. Which specific technique should you look for in the process memory that indicates process hollowing?
Writing to the memory space of a suspended process is required for hollowing.
Why this answer
Process hollowing involves creating a legitimate process in a suspended state and replacing its memory with malicious code, a hallmark of execution techniques.
You are auditing a web application server. You discover it is running with high privileges. What is the standard security practice to mitigate this risk?
This limits the impact if the application is compromised.
Why this answer
Applications should always run with the minimum necessary permissions, usually as a dedicated service account with restricted access.
You are performing a vulnerability assessment on a server. Which TWO of the following indicators would suggest an asset is part of the 'Critical' category?
Data sensitivity (PII/Financial) is a major driver of criticality.
Why this answer
Assets that hold PII or are required for business continuity are by definition critical.
You are performing STRIDE threat modeling on a new web application. A developer asks how to mitigate a 'Tampering' threat identified during the design phase. Which control is most effective?
Hashing and signatures ensure data integrity, preventing tampering.
Why this answer
Tampering threats involve unauthorized modification of data. Digital signatures and integrity checks ensure that data has not been altered.
You are performing a quantitative risk assessment. The SLE (Single Loss Expectancy) is $10,000, and the ARO (Annualized Rate of Occurrence) is 0.5. What is the ALE (Annualized Loss Expectancy)?
Calculation is correct.
Why this answer
ALE = SLE * ARO. $10,000 * 0.5 = $5,000.
You are conducting an asset inventory and discover a device communicating with a known malicious IP address. The device is a corporate laptop. What is the most immediate, effective containment action?
Endpoint isolation via EDR allows for continued management of the device while blocking all network traffic except to the management console.
Why this answer
Isolating the endpoint via the EDR platform is the industry-standard 'containment' step to prevent lateral movement while maintaining a forensic connection.
A security appliance flags a high volume of traffic from a single internal host to a series of random external IP addresses. This is a classic indicator of which activity?
Involves connecting to many IPs to probe for open ports.
Why this answer
Scanning or discovery phases often manifest as a single host attempting to connect to numerous external destinations in a short window.
Which type of evidence is collected to prove that a specific individual was responsible for an action on a system?
Ensures that an action cannot be denied by the user.
Why this answer
Non-repudiation refers to the assurance that the sender of information is provided with proof of delivery and the recipient is provided with proof of the sender's identity.
Which of the following activities is best categorized as an 'eradication' step in the incident response lifecycle?
Removing unauthorized access points or credentials is a primary eradication task to ensure the attacker cannot re-enter.
Why this answer
Eradication involves removing the root cause, such as cleaning malware or removing unauthorized user accounts.
Which TWO of the following are examples of good asset inventory management practices?
A CMDB provides the necessary context and relationship mapping for security and operations.
Why this answer
Automated discovery tools and maintaining a comprehensive CMDB are foundational elements of effective asset inventory.
You are tasked with hardening an endpoint using the CIS Benchmark for Windows 10. You need to ensure that the 'Local Account Password Complexity' is enforced. Which GPO path should you navigate to?
This is the correct path to modify the local password complexity requirements.
Why this answer
The standard path for local security policy settings in GPO is Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Password Policy.
During a Microsoft Sentinel incident investigation, you notice that a specific alert triggered by a custom analytic rule is creating too many false positives due to a noisy service account. You want to exclude this account without disabling the entire rule. What is the most effective approach?
Watchlists provide a scalable way to maintain inclusion/exclusion lists for KQL queries.
Why this answer
In Sentinel, using a Watchlist allows you to maintain a list of excluded entities and reference them in KQL queries to filter out known noisy sources.
A security analyst is mapping organizational assets to the NIST Cybersecurity Framework. Which category is specifically responsible for maintaining the resilience of critical infrastructure?
Recover includes recovery planning and resilience improvements.
Why this answer
The NIST CSF Core consists of five functions: Identify, Protect, Detect, Respond, and Recover. Recover is the function focused on resilience and restoring capabilities.
A phishing simulation resulted in a user clicking a link. What is the next logical step in the incident response process?
The necessary step to assess the extent of the impact.
Why this answer
Checking logs for successful logins or abnormal activity from that user account is critical to determine if the phishing attempt led to an account compromise.
You are reviewing logs in Splunk and identify a suspicious process spawning 'cmd.exe' from 'wsmprovhost.exe'. Which MITRE ATT&CK tactic does this behavior most directly align with?
Using WinRM/PowerShell Remoting to execute commands is a primary technique for Lateral Movement.
Why this answer
The spawning of a command shell from a remote management process is a classic indicator of Lateral Movement using remote execution.
You are using an ELK Stack (Elasticsearch, Logstash, Kibana) for incident response. You have identified a time-based spike in traffic. What is the most efficient way to query for the top 10 unique source IP addresses for a specific destination over the last hour using Kibana Discover?
Lens aggregations are optimized for quickly identifying top-N occurrences.
Why this answer
The 'Lens' or 'Visualize' feature in Kibana allows for aggregation by field, which is the most efficient way to summarize top traffic sources.
A security analyst is triaging an alert about an unauthorized login from an unusual country. What is the first priority in the response workflow?
Essential to differentiate between authorized travel and malicious access.
Why this answer
Verifying the incident (confirming if it was a legitimate user traveling or an actual breach) is the vital first step to prevent unnecessary incident escalation.
Which THREE items are typically included in a formal Risk Register?
Critical for tracking progress.
Why this answer
A risk register tracks risks, including their probability, impact, and mitigation status.
After an incident, you need to preserve the volatile memory of a compromised machine. What is the correct order of operations according to the Order of Volatility?
RAM is more volatile and must be captured first.
Why this answer
Memory (RAM) should be captured before disk storage because memory content is lost as soon as the machine is powered off or rebooted.
Which THREE of the following are common steps in performing a security audit of a Linux system?
Checking for over-privileged accounts helps prevent lateral movement.
Why this answer
Checking running processes, user account permissions, and listening ports are key to finding unauthorized activity.
A security analyst is configuring an alert in Splunk Enterprise Security to detect potential brute force attacks. The analyst must identify the specific notable event aggregate field that prevents the creation of duplicate alerts for the same source IP over a defined time window. Which field should be utilized?
The 'groupby' field is used in correlation searches to ensure that events sharing a common attribute (e.g., source IP) are aggregated into a single notable event.
Why this answer
The 'drilldown_earliest_offset' or similar mechanisms are auxiliary, but 'dedup_field' or 'groupby' fields in the correlation search configuration determine how Splunk aggregates events to prevent alert fatigue.
Which TWO of the following are true regarding the use of hashing in digital forensics?
Any change to the file will change the hash.
Why this answer
Hashing ensures data integrity and can be used to identify known files (e.g., system files) to filter them out of an investigation.
Which THREE steps are part of the 'Preparation' phase of incident response?
Provides the framework for IR.
Why this answer
Preparation involves ensuring the team is trained, the necessary tools are available, and the policies are in place to handle incidents.
Which THREE of the following are examples of 'Access Control' implementations?
Discretionary Access Control (DAC) via file permissions is a primary control mechanism.
Which THREE of the following are 'Command and Control' techniques?
A common C2 channel.
Why this answer
Web service protocols, non-standard port traffic, and standard application layer protocols are all C2 channels.
You are configuring a 'Watchlist' in Sentinel to detect when a specific list of known malicious IPs interact with your environment. What is the correct method to map this watchlist to an analytics rule?
The standard method for integrating watchlists into analytics rules.
Why this answer
In Microsoft Sentinel, you use the 'in' operator combined with the _GetWatchlist function in your KQL query to compare incoming logs against the watchlist content.
An adversary is using a living-off-the-land (LotL) binary to execute commands. Why is this preferred over a custom malware?
Using system tools helps blend in with administrative behavior.
Why this answer
LotL binaries are legitimate system tools, making them harder to flag as malicious by signature-based defenses.
Which THREE of the following are common sources for SIEM data ingestion to assist in incident detection?
Essential for network perimeter visibility.
Why this answer
SIEMs ingest data from various layers including identity providers, network infrastructure, and endpoint monitoring tools to provide comprehensive visibility.
What is the primary difference between a Red Team and a Blue Team in a security simulation?
This describes the core function of adversarial simulation.
Why this answer
The Red Team performs the offensive actions to emulate threats, while the Blue Team defends and monitors.
Which THREE of the following are considered 'Collection' techniques?
A collection technique.
Why this answer
Screen capture, audio capture, and file collection are all ways to steal data.
Which TWO elements should be included when performing threat modeling using the STRIDE methodology?
Necessary to trace attack vectors.
Why this answer
STRIDE focuses on identifying threats based on specific categories like Spoofing and Information Disclosure.
During a simulation, you notice a process spawning child processes from 'wmic.exe'. What is this technique often used for?
WMIC allows the execution of commands on local or remote systems.
Why this answer
WMIC is often used for remote execution and discovery in Windows environments.
You are auditing a Linux server for persistence mechanisms. Which file is commonly used by attackers to hide malicious code that executes upon every user login?
A script file executed for every interactive bash session.
Why this answer
The '.bashrc' file in a user's home directory is a standard location for executing code at login, making it a common persistence vector for attackers.
You are troubleshooting a failure in a 'Certificate-Based Authentication' setup for a VPN. The logs show 'Handshake Failure'. What tool should you use to verify the server's certificate chain status?
This command displays the full certificate chain and provides debug info on the handshake process.
Why this answer
OpenSSL is the industry standard CLI tool for diagnosing TLS handshake issues and verifying certificate chain validity.
What is the primary goal of the 'Eradication' phase in incident response?
The definition of eradication.
Why this answer
The goal of eradication is to remove the root cause of the incident, such as deleting malware, removing accounts, or closing vulnerabilities.
You are hardening a web server. Which directive in an Apache configuration file helps prevent Clickjacking attacks?
This directive ensures the page can only be displayed in frames on the same site.
Why this answer
The 'X-Frame-Options' header prevents the site from being embedded in iframes, which is the primary vector for clickjacking.
While monitoring security logs in Splunk for your critical database server, you observe a spike in '401 Unauthorized' errors followed by a '200 OK' success from a known administrative account. How should you investigate this to confirm a potential credential stuffing attack?
Comparing User-Agent and source IP patterns against historical baselines is the standard method for identifying credential stuffing anomalies.
Why this answer
To distinguish between a user mistyping a password and an automated attack, you must correlate the timing, source IP distribution, and the subsequent behavior of the account.
A user reports they cannot access a shared drive. You find the 'Effective Access' is 'Deny'. What is the most likely cause?
Explicit Deny entries in Windows ACLs take precedence over Allow permissions.
Why this answer
In Windows, an explicit 'Deny' permission always overrides any 'Allow' permissions granted through other groups.
In a cloud environment, you are configuring a Security Group for an EC2 instance. To allow only incoming web traffic over HTTPS from a specific subnet, which configuration is most secure?
This restricts traffic to the necessary port and limits access to the specific subnet.
Why this answer
The principle of least privilege dictates specifying the exact port and source CIDR block rather than using broad '0.0.0.0/0' entries.
You are utilizing the MITRE ATT&CK framework to document an incident. Which object represents the 'what' of the attack, such as the specific software or tool used?
Software represents the tools or malware used.
Why this answer
The 'Software' object in MITRE ATT&CK describes the tools used by adversaries to perform techniques.
You are investigating a suspicious process on Windows. You see it is running from 'C:\ProgramData'. Which tool allows you to check if the process signature is valid?
Specifically designed to verify digital signatures.
Why this answer
'sigcheck' from the Sysinternals suite is the standard command-line utility for verifying the digital signature of a file.
A security analyst is reviewing access logs and notices a user with 'Administrator' rights performing daily data entry. Which principle is being violated?
The user has excessive privileges for their tasks.
Why this answer
The principle of Least Privilege dictates that users should only have the minimum level of access required to perform their job functions.
During a forensic analysis, you find a suspicious file that was renamed to look like a system file. What is the most reliable way to identify its true nature?
Provides a unique, verifiable identity for the file.
Why this answer
Calculating the file hash (e.g., SHA-256) and comparing it against known databases (like VirusTotal or an internal whitelist) reveals the file's identity regardless of its name.
An analyst needs to verify the hash of a downloaded binary to ensure it has not been tampered with. Which command is used on Windows PowerShell?
This cmdlet supports SHA256 and other algorithms to verify file integrity.
Why this answer
Get-FileHash is the native PowerShell cmdlet for calculating file integrity hashes like SHA256.
You notice a surge in outbound traffic from a workstation to a series of random external IP addresses. This suggests a potential botnet infection. What is the most appropriate forensic data to collect first?
NetFlow provides source, destination, and volume data, which is perfect for identifying C2 pattern anomalies.
Why this answer
NetFlow or VPC Flow Logs are the best way to capture the patterns of outbound communication to identify command-and-control (C2) behavior.
During the post-incident recovery phase, which TWO actions are essential to ensure the environment is returned to a secure state?
Increased monitoring is required to ensure that any remaining artifacts or re-entry attempts are caught quickly.
Why this answer
Verification of security controls and monitoring for recurrence are critical to ensure the incident does not repeat.
You are configuring AWS Security Groups for a web server. Which rule set follows the 'Principle of Least Privilege' best?
This limits ingress to standard web ports and egress to only what the server needs to function.
Why this answer
Least privilege dictates allowing only the specific ports required (80/443) from the necessary source (anywhere or a load balancer) and nothing else.
When performing digital forensics on a volatile memory dump, which THREE artifacts should you prioritize to identify evidence of fileless malware?
Malicious code often loads suspicious DLLs or utilizes unique system handles.
Why this answer
Fileless malware resides in memory and often leaves traces in process structures, injected code, and handles.
When conducting digital forensics on a volatile memory dump using the Volatility Framework, which TWO plugins would be most effective in identifying malicious kernel-mode rootkits?
The System Service Descriptor Table plugin detects hooks, which are a common rootkit technique.
Why this answer
ssdt and modules are critical for identifying hooking and unauthorized kernel objects.
When drafting an incident report, what is the most important element to include for the executive summary?
The primary concern for leadership.
Why this answer
The executive summary must communicate the business impact and current status clearly to non-technical stakeholders.
During an incident response engagement involving a ransomware attack, the team decides to isolate the affected endpoint using an EDR solution. What is the expected behavior of the EDR tool during the 'network isolation' process?
EDR agents typically push a firewall rule that blocks all lateral movement and external traffic while allowing the management channel to stay open.
Why this answer
Network isolation in EDR typically uses a host-based firewall policy to block all traffic except for the management connection to the EDR controller.
Which of the following is considered an 'Execution' tactic in the MITRE ATT&CK framework?
PowerShell is a primary tool for command execution.
Why this answer
Execution involves running malicious code on a system.
Which THREE phases of the incident response lifecycle involve the most interaction with stakeholders?
Requires planning with management.
Why this answer
The Preparation, Communication, and Post-Incident phases require heavy interaction with management, users, and external parties.
Which THREE behaviors are characteristic of a potential data exfiltration attempt?
Technique used to bypass perimeter firewalls.
Why this answer
Data exfiltration is often characterized by unusual spikes in outbound traffic, use of non-standard ports, or connections to unusual or high-risk geographic locations.
You are managing access for a cloud-native application using AWS IAM. You need to ensure that an EC2 instance can only access a specific S3 bucket. What is the most secure way to implement this?
IAM roles provide temporary credentials and are the identity-based mechanism for granting scoped access to AWS services.
Why this answer
IAM roles attached to EC2 instances are the standard and secure way to manage permissions without hardcoding keys or using overly broad policies.
Which action constitutes 'Discovery' as defined by the MITRE ATT&CK framework?
Commands to identify user context or network shares are Discovery.
Why this answer
Discovery involves gathering information about the system and network to plan subsequent steps.
In a FAIR (Factor Analysis of Information Risk) model, what is the 'Loss Event Frequency' composed of?
FAIR specifically defines this relationship.
Why this answer
FAIR defines Loss Event Frequency as the combination of Threat Event Frequency and Vulnerability (the probability that a threat event results in a loss).
Which TWO documents are essential to provide to a forensic investigator?
Tracks the movement and handling of evidence.
Why this answer
A proper chain of custody form and the incident timeline are critical for legal and forensic proceedings.
Which THREE indicators should an analyst monitor to identify a potential web server compromise?
Common sign of persistence or redirection.
Why this answer
Web server compromises are often identified by changes in file integrity, unusual outbound traffic, and unexpected server-side process activity.
What is the primary objective of a 'Business Impact Analysis' (BIA)?
BIA prioritizes processes based on impact.
Why this answer
The BIA identifies the potential consequences of disruption to business functions and processes.
You are configuring a Splunk Enterprise Security (ES) Correlation Search to detect potential brute-force activity. You need to ensure the search generates a notable event only when the threshold of 10 failed logins occurs within a 5-minute window for a specific user. Which Correlation Search attribute should be modified?
The time window restricts the lookback period to evaluate the threshold logic.
Why this answer
In Splunk ES, the 'Time Window' and 'Threshold' settings within the Correlation Search editor are used to define the sensitivity and frequency of event generation.
You are using Tenable.io to manage vulnerabilities across a hybrid environment. You notice that several endpoints are not appearing in the 'Asset Inventory' dashboard despite having the Nessus Agent installed. What is the first troubleshooting step you should take?
The 'nessuscli' command-line utility is the native tool for verifying agent-to-manager connectivity status.
Why this answer
The Nessus Agent must communicate with the Tenable.io platform via a specific port. If the agent isn't showing up, checking the link status and connectivity to the cloud backend is the primary requirement.
Which TWO of the following are primary functions of an Information Security Governance program?
Aligns security with business objectives.
Why this answer
Governance ensures security aligns with business goals and manages risk effectively.
What is the primary purpose of an 'Endpoint Detection and Response' (EDR) solution?
This is the core function of an EDR solution.
Why this answer
EDR tools are designed specifically to detect, investigate, and remediate advanced threats on endpoint devices.
You are investigating a potential insider threat. Which log is most useful for tracking file deletion activity on a Windows file server?
Tracks access and changes to specific files/folders.
Why this answer
Enabling Object Access auditing in the Windows Security policy allows you to track specific file actions, including deletion (Event ID 4660).
A user reports they cannot access a shared drive following a suspected ransomware infection. What is the immediate containment action according to standard incident response best practices?
The primary first step for containment of potential malware propagation.
Why this answer
Isolating the affected host from the network prevents the ransomware from spreading to other shares or command-and-control servers while preserving local evidence.
When classifying a security incident using the NIST SP 800-61 framework, which phase is focused on identifying the precursors and indicators of an attack?
This phase involves identifying, assessing, and analyzing evidence to confirm an incident.
Why this answer
The Detection and Analysis phase is where the team processes logs and alerts to identify if an event constitutes an incident.
Which TWO of the following actions are considered best practices during the 'Containment' phase of an incident response workflow?
Isolation prevents further spread.
Why this answer
Containment focuses on stopping the spread of the attack without destroying evidence.
During threat modeling, you identify that an adversary could impersonate a service account. Which control is most effective against this?
mTLS ensures both sides of the connection are authenticated.
Why this answer
Mutual TLS (mTLS) or strong service-to-service authentication prevents impersonation by verifying the identity of both sides.
Which TWO of the following are examples of 'Initial Access' tactics?
A primary initial access vector.
Why this answer
Phishing and exploiting public-facing applications are two common ways to gain the first foothold in an environment.
Which THREE of the following represent critical areas to inspect when a web application has been suspected of an injection attack?
Logs capture the malicious input payloads used in the attack.
Why this answer
Input sanitization, database query logic, and logs are the primary areas to investigate during an injection incident.
An attacker uses 'T1133 External Remote Services' to gain access. What does this involve?
This is the classic technique for T1133.
Why this answer
T1133 involves exploiting VPNs, Citrix, or other external-facing access points to enter a network.
Practice CCOA by domain
Target a specific domain to shore up weak areas.