36 questions · Security Operations topic · All types, answers revealed
Which component in the MITRE ATT&CK framework should be mapped to an SOC alerting rule to ensure the alert covers a specific adversary objective?
Techniques represent the specific methods an adversary uses to achieve their goal.
Why this answer
The 'Technique' ID is the core component that describes the 'how' of an adversary's action.
In Splunk Enterprise Security, which dashboard should the SOC manager review to evaluate the effectiveness of the current correlation searches and the volume of notable events?
This dashboard displays the health and performance metrics of correlation searches.
Why this answer
The Content Management dashboard provides insights into the performance, trigger volume, and status of correlation searches.
Which THREE pieces of information should be included in an 'Incident Notification' for executive stakeholders?
Executives need to know how the incident is being resolved.
Why this answer
Executives need the business impact, the current status, and the next planned actions.
A security analyst is troubleshooting a failed connection to an internal application that is protected by Zscaler Private Access (ZPA). Which tool should the analyst use to verify if the policy is blocking the request?
ZPA Diagnostics allows viewing the logs of connection attempts and the associated policy decisions.
Why this answer
The Zscaler 'Diagnostics' or 'Insights' portal provides detailed logs on why a specific user-to-app connection was denied or allowed.
Which TWO data sources are most critical for detecting lateral movement within a corporate network?
Authentication logs show the 'who' and 'where' of credential usage on other hosts.
Why this answer
Lateral movement is characterized by network traffic between internal hosts and authentication logs indicating access attempts.
Which THREE types of data should be ingested by a SIEM to improve its threat detection capabilities?
Identity logs allow detection of credential misuse.
Why this answer
A robust SIEM needs endpoint logs, network logs, and identity/access logs to correlate threats.
An organization uses Microsoft Sentinel. To ensure that an automated incident response playbook only triggers when a high-severity alert originates from a specific production subnet, where should the condition be defined?
Automation rules allow filtering by alert severity and entity values before triggering the playbook.
Why this answer
The logic app trigger conditions or the Sentinel Automation Rule 'If' conditions allow filtering based on alert properties like severity and entity fields.
When managing a FortiGate firewall, which feature allows the SOC to dynamically update network objects based on external threat feeds?
External Connectors integrate with threat feeds to update dynamic address objects.
Why this answer
FortiGate 'External Connectors' allow the ingestion of dynamic threat intelligence lists.
In the context of the Google Cloud Security Command Center (SCC), which feature provides a prioritized list of findings based on the criticality of the impacted asset?
This feature highlights findings that pose the highest risk to the business.
Why this answer
The 'Risk' scoring in SCC helps analysts focus on findings that affect the most critical infrastructure.
Which SOC process ensures that all security tools are configured to log at the same time standard to prevent confusion during timeline analysis?
Synchronizing clocks ensures that timestamps across the entire environment are consistent.
Why this answer
NTP (Network Time Protocol) synchronization is essential for accurate event correlation.
When configuring CrowdStrike Falcon to isolate a host during an active incident, what is the prerequisite requirement for the agent's communication state?
Host isolation relies on the agent receiving the command from the cloud; if the host is offline, it cannot receive the instruction.
Why this answer
The Falcon agent must have an active heartbeat to the Falcon Cloud to receive the 'Isolate' command.
Which THREE actions should be taken when performing an incident post-mortem according to industry best practices?
Analyzing the timeline reveals bottlenecks and inefficiencies.
Why this answer
Post-mortems focus on identifying root causes, improving processes, and ensuring documentation is captured.
Which TWO of the following are primary components of an effective Incident Response (IR) program?
Policies establish the authority and requirements for the IR program.
Why this answer
An IR program requires both organizational support (Policy) and operational capability (Personnel/Training).
In Okta, to restrict administrative access to a specific geographic region during an active session, which policy should be modified?
This allows for defining network-based conditions, including location, for all sessions.
Why this answer
The 'Global Session Policy' or specific 'Authentication Policy' rules control access based on location-based conditions.
In Rapid7 InsightVM, what is the best way to categorize assets into groups based on their business function for targeted vulnerability reporting?
Dynamic groups automatically update membership based on criteria such as tags or OS types.
Why this answer
Asset groups allow for logical organization of infrastructure based on attributes like department or function.
Which THREE technical controls are effective for limiting the impact of lateral movement?
Restricts traffic between workloads to prevent lateral hopping.
Why this answer
Network segmentation, identity restrictions, and endpoint security prevent attackers from moving freely.
Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?
C2 communication is a key sign of an active threat.
Why this answer
IOCs are evidence that a system has been compromised; common types include malicious file hashes and suspicious C2 IP addresses.
An organization is investigating a potential lateral movement incident in AWS. Which CloudTrail event field provides the most reliable indicator of the source IP address for an API call performed by an IAM role?
This field records the IP address from which the API request originated.
Why this answer
The 'sourceIPAddress' field in the CloudTrail log entry directly identifies the client IP that made the API request.
Informational level includes general events like denied connections.
Why this answer
Level 6 (Informational) is required to capture the 'Deny' flow logs in Cisco ASA systems.
Which THREE activities are included in the 'Preparation' phase of the IR life cycle?
Drills ensure the team is ready for real incidents.
Why this answer
Preparation involves setting up tools, training the team, and defining the procedures necessary for effective response.
When configuring a Qualys scanner to perform authenticated scans on Windows, what is the 'Windows Authentication Record' primarily used for?
Authenticated scans allow the engine to inspect registry keys, installed software, and local patches.
Why this answer
It provides the scanner with the credentials and privileges necessary to log into the target system and inspect local registry/file configurations.
Which TWO communication channels are typically used for emergency incident coordination within a SOC?
Bridge lines allow for real-time collaboration between teams.
Why this answer
Secure out-of-band communication is vital when primary internal email systems may be compromised.
During an incident, which document is used by the SOC to record evidence, timestamps, and actions taken to ensure admissibility in a legal proceeding?
This document ensures the integrity and legal admissibility of evidence.
Why this answer
The Chain of Custody document tracks the handling of evidence from discovery through to investigation.
When using Palo Alto Networks Cortex XSOAR, which component is responsible for orchestrating the execution of scripts across multiple third-party integrations?
Playbooks are the workflows that define the automated steps and cross-tool actions.
Why this answer
The XSOAR 'Playbook' engine manages the logic flow and script execution across various integrated products.
In an incident response plan, which metric is most useful for measuring the 'dwell time' of a threat actor?
MTTD directly relates to how long a threat remains active before it is discovered.
Why this answer
Dwell time is the period between the initial compromise and the time the organization detects the breach.
Which phase of the NIST Incident Response Life Cycle involves activities like system sanitization and validation of system integrity?
This phase includes cleaning systems and returning them to production.
Why this answer
Recovery includes restoring systems to normal operation and confirming they are secure.
Which THREE factors are required to calculate the 'Risk' of a vulnerability for reporting purposes?
Impact depends on how critical the asset is to the business.
Why this answer
Risk is typically calculated as Likelihood x Impact, where Likelihood is influenced by Threat and Vulnerability, and Impact is determined by Asset Criticality.
In VMware Carbon Black Cloud, which feature should be enabled to block unauthorized scripts while allowing signed binaries from trusted software vendors?
ATP policies provide granular control over process execution based on trust.
Why this answer
The 'Advanced Threat Prevention' policies allow for specific exclusion and blocking rules based on file reputation and signing certificates.
In Tenable.io, when prioritizing vulnerability remediation, which metric provides the best insight into the likelihood of a vulnerability being exploited in the wild?
VPR uses real-time threat intelligence to measure the urgency of remediation.
Why this answer
The Vulnerability Priority Rating (VPR) incorporates threat intelligence and exploit code availability, making it more accurate for risk-based prioritization than CVSS alone.
Which document describes the specific steps an analyst should take when a 'Phishing' alert is triggered in the SIEM?
Playbooks provide the operational, step-by-step instructions for specific incident types.
Why this answer
A Playbook or Runbook provides step-by-step guidance for specific, repeatable incident types.
When implementing FIM (File Integrity Monitoring) in Tripwire Enterprise, what is the specific purpose of a 'Promotion' action?
Promotion is the mechanism to officially acknowledge a change as authorized and update the baseline.
Why this answer
Promotion updates the 'Known Good' baseline with the state of the monitored file from a current scan.
When analyzing network traffic in Wireshark for potential exfiltration, what specific filter allows you to isolate TCP traffic where the payload size exceeds 10MB?
The 'tcp.len' field represents the length of the TCP payload, and the filter evaluates this against the 10MB threshold.
Why this answer
While Wireshark does not have a single simple filter for payload size without complex length calculations, the correct syntax involves identifying TCP segments that contain payload.
Which SOC metric is most appropriate to present to executive leadership to demonstrate the business value of security investments?
MTTR demonstrates operational efficiency and reduced risk exposure time.
Why this answer
Executive leadership cares about the reduction in risk and the financial impact of incidents, not technical metrics like 'events per second'.
Which TWO metrics are essential for evaluating the performance of a SOC team in identifying and containing threats?
Measures how fast the SOC identifies a potential breach.
Why this answer
MTTD and MTTC are standard industry metrics used to measure SOC efficiency.
Which document is considered the primary 'source of truth' for defining the SOC's roles, responsibilities, and communication paths during a major security incident?
The IRP outlines the management, roles, and escalation procedures for incidents.
Why this answer
The Incident Response Plan (IRP) defines the strategy and governance for responding to incidents.
A Microsoft Entra ID (Azure AD) user account is suspected of compromise. What is the most effective way to invalidate all active session tokens immediately?
This action explicitly forces the revocation of all currently active refresh tokens.
Why this answer
The 'Revoke sessions' action in the Entra ID user blade forces the user to re-authenticate and clears all current refresh tokens.
Ready to test yourself?
Try a timed practice session using only Security Operations questions.