Security Operations practice questions

Forensic investigator

Why wrong: A forensic investigator's primary role during an incident is to meticulously identify, collect, preserve, and analyze digital evidence to determine the scope, cause, and impact of the breach. While crucial for understanding the incident and potential legal action, this specialized role does not encompass the overarching coordination, strategic decision-making, or resource allocation required for the entire incident response effort. Their focus is on data integrity and analysis, not incident management.

Communications lead

Why wrong: The communications lead is responsible for developing and disseminating accurate, timely, and consistent messages to internal and external stakeholders, including employees, customers, media, and regulatory bodies. Their expertise lies in public relations and crisis communication, ensuring reputational damage is minimized. However, this role is distinct from the operational coordination of technical teams, strategic response planning, or resource management necessary to contain and eradicate the incident itself.

SOC Tier 1 analyst

Why wrong: A SOC Tier 1 analyst serves as the first line of defense, primarily responsible for monitoring security alerts, performing initial triage, and escalating potential incidents to higher tiers or the incident response team. Their duties involve basic analysis, alert validation, and following predefined playbooks. While essential for early detection, their scope is limited to initial alert handling and does not include the strategic oversight, cross-functional team coordination, or executive decision-making required to manage a full-scale security incident.

Wireshark

Why wrong: Wireshark is a widely used network protocol analyzer designed to capture and interactively browse the data flowing on a computer network. It operates by intercepting network packets, allowing analysts to examine their headers and payloads to understand communication patterns, troubleshoot network issues, or detect network-based attacks. However, it is entirely unsuitable for analyzing a memory dump, as it does not process the internal state of a system's RAM but rather external network traffic.

EnCase

Why wrong: EnCase is a comprehensive digital forensics platform primarily utilized for acquiring, preserving, and analyzing data from persistent storage devices such as hard drives, solid-state drives, and mobile devices. While it offers robust capabilities for disk imaging, file system analysis, and evidence recovery from non-volatile storage, it lacks the specialized parsers and plugins required to effectively interpret the complex, volatile data structures present within a system's RAM for memory forensics.

FTK Imager

Why wrong: FTK Imager is a free, standalone software tool primarily used for creating forensic images of hard drives, logical drives, or specific files, and for previewing their contents without altering the original evidence. While it possesses the capability to capture live memory from an active system, its core functionality and analytical features are not designed for the in-depth interpretation of complex data structures within a memory dump for forensic analysis. It serves more as an acquisition and preview tool rather than a comprehensive memory analysis platform.

DoS

Why wrong: A Denial of Service (DoS) attack aims to disrupt the availability of a service or resource, making it inaccessible to legitimate users. The scenario describes a pattern leading to unauthorized access, not an overwhelming of system resources or a disruption of service availability, which would be the primary indicator of a DoS attack.

Insider threat

Why wrong: An insider threat originates from an individual who has authorized access to an organization's assets and misuses that access, either intentionally or unintentionally. The SIEM logs indicating a pattern of attempts resulting in unauthorized access strongly suggest an external actor attempting to breach defenses, rather than an authorized user exploiting their existing privileges.

Social engineering

Why wrong: Social engineering relies on psychological manipulation to deceive individuals into performing actions or divulging confidential information. The SIEM logs revealing a technical pattern of attempts and subsequent unauthorized access points to a direct technical attack, such as a brute-force attempt, rather than a human-centric deception tactic.

Storing evidence in a publicly accessible location

Why wrong: Storing forensic evidence in an unsecured or publicly accessible location violates the core principles of physical security and chain of custody. It exposes the evidence to unauthorized access, tampering, or destruction, which immediately invalidates its admissibility in a court of law. Evidence must always be kept in a secure, controlled environment like an evidence locker.

Encrypting the evidence at all times

Why wrong: While encrypting evidence protects its confidentiality during storage and transit, it is not a strict requirement for establishing a legally defensible chain of custody. Furthermore, encrypting evidence at all times is practically impossible during active analysis phases where the data must be decrypted to be read. The primary focus of forensics is integrity and non-repudiation rather than constant encryption.

Data breach

Why wrong: A data breach is a critical security incident involving the unauthorized access, acquisition, use, disclosure, or theft of sensitive, protected, or confidential data. This incident type directly impacts the confidentiality and potentially the integrity of information assets, often leading to significant regulatory penalties, reputational damage, and financial losses for an organization. Its inclusion as a primary incident category is essential due to its severe consequences and the specific response protocols it necessitates.

Social engineering

Why wrong: Social engineering is primarily an attack vector or technique used to manipulate individuals into performing actions or divulging confidential information, rather than a standalone incident category like a data breach or malware infection. While it is a common precursor, the *resulting* security event, such as unauthorized access, data exfiltration, or a system compromise, would typically be classified under a more specific incident category. Therefore, it describes the *how* of an attack, not the *what* of the incident itself.

Perform in-depth forensic analysis of the server

Why wrong: A Tier 1 SOC analyst's primary role is initial triage, containment, and escalation, not deep forensic analysis. Performing an in-depth forensic examination requires specialized tools, advanced analytical skills, and significant time, which are typically responsibilities of Tier 2 or Tier 3 analysts. Engaging in such a complex task at Tier 1 would delay critical containment efforts and exceed their defined operational scope, hindering the overall incident response process.

Implement a permanent firewall rule to block the malware

Why wrong: Implementing permanent network changes, such as a firewall rule, is a significant action that requires formal change management processes and approval from higher-tier personnel. A Tier 1 analyst lacks the authority and comprehensive understanding of potential network impacts to make such a lasting configuration modification. This action is beyond their immediate incident response mandate and could inadvertently disrupt legitimate services or create new vulnerabilities.

Delete the malware sample without preserving evidence

Why wrong: Deleting a malware sample without proper preservation is a critical error that destroys valuable forensic evidence. Evidence preservation is paramount in incident response, as it allows for root cause analysis, threat intelligence gathering, and potential legal action against perpetrators. Such an action would hinder subsequent investigations by higher-tier analysts, making it impossible to understand the attack vector, attacker TTPs, or the full scope of compromise, thereby impeding future defensive measures.

Responsible

Why wrong: The "Responsible" role in a RACI matrix designates the individual or team directly tasked with executing the work required to complete the activity. While the Change Advisory Board (CAB) approves the change, it does not physically implement the patch or configure the system. Instead, operational teams, such as system administrators or network engineers, are assigned the "Responsible" role for the hands-on execution of the approved change.

Informed

Why wrong: The "Informed" role refers to stakeholders who need to be kept abreast of the progress, status, or outcome of a decision or activity, typically after it has occurred or reached a significant milestone. The CAB's primary function here is to make the approval decision itself, not merely to receive updates about a decision made by others. Therefore, the CAB is not simply "Informed" regarding its own core function.

Accountable

Why wrong: The "Accountable" role signifies the single individual or group ultimately answerable for the correct and thorough completion of the deliverable or decision, even if others perform the work. The CAB, by approving or rejecting the change request, assumes ultimate ownership and responsibility for the consequences, risks, and overall outcome of that decision. This includes ensuring compliance with policies and managing any resulting impacts.

Reciprocal agreement

Why wrong: A reciprocal agreement involves two organizations agreeing to provide backup facilities for each other in the event of a disaster. This strategy is highly dependent on the availability and capacity of the partner's resources, which may be compromised during a widespread regional disaster or if the partner experiences their own outage. The lack of dedicated resources and potential for conflicting priorities often leads to unpredictable and extended Recovery Time Objectives (RTOs), making it unsuitable for rapid recovery.

Warm site

Why wrong: A warm site is a partially equipped facility that contains essential hardware and network infrastructure, but typically lacks current data and fully configured applications. While the building and basic utilities are in place, data restoration from backups and application configuration are required before operations can resume. This necessitates a moderate Recovery Time Objective (RTO), usually ranging from several hours to a few days, as significant setup is still needed.

Cold site

Why wrong: A cold site is an empty facility with basic utilities like power and cooling, but no hardware, software, or network infrastructure pre-installed. In the event of a disaster, all necessary equipment must be procured, delivered, installed, and configured, and data must be restored from backups. This extensive setup process results in the longest Recovery Time Objective (RTO) among traditional DR strategies, often spanning weeks or even months.

Vulnerability scanning

Why wrong: Vulnerability scanning is an active process of identifying security weaknesses in systems and applications, typically performed by dedicated vulnerability management tools. While a Security Information and Event Management (SIEM) system can ingest and analyze the output from these scanners to correlate findings with event logs, it does not possess the native functionality to initiate or execute vulnerability scans itself. Its primary role is log analysis and event management, not active system probing.

Automated patch deployment

Why wrong: Automated patch deployment falls under the domain of patch management systems or configuration management tools, which are designed to distribute and install software updates and security patches across an organization's endpoints and servers. A SIEM's function is to monitor and alert on security events, including potential indicators of unpatched vulnerabilities or failed patch deployments, but it does not directly manage or execute the patching process. This is an operational task distinct from security monitoring.

Reciprocal agreement

Why wrong: A reciprocal agreement involves two organizations agreeing to provide backup facilities for each other in a disaster. However, this arrangement rarely guarantees immediate availability or specific recovery time objectives (RTOs) because the other organization may also be experiencing issues or have its own critical operations to prioritize. Furthermore, legal and logistical complexities, including differing hardware/software configurations and security requirements, often make this an unreliable primary disaster recovery strategy for stringent RTOs.

Warm site

Why wrong: A warm site is a partially equipped facility with necessary hardware and network connectivity, but it lacks current data and may require significant configuration and data restoration efforts. While it can be brought online within hours, this setup time typically exceeds stringent recovery time objectives (RTOs) that demand immediate operational resumption. The need to install applications, restore recent backups, and perform extensive testing means it cannot guarantee near-instantaneous recovery.

Cold site

Why wrong: A cold site is a basic facility with essential utilities like power and cooling, but it contains no hardware, software, or network infrastructure. Bringing a cold site online requires procuring, installing, and configuring all necessary equipment, along with restoring data, which can take days or even weeks. This extensive lead time makes a cold site unsuitable for organizations with critical systems requiring rapid recovery time objectives (RTOs) measured in minutes or a few hours.

RAM contents

Why wrong: RAM (Random Access Memory) is highly volatile, meaning its contents are lost when power is removed or the system is rebooted. While critical for capturing active processes, open files, and cached data, it is generally considered less volatile than CPU registers. The data in RAM persists longer than the transient state held within CPU registers, making its capture a high priority, but secondary to the most immediately ephemeral data.

Hard disk contents

Why wrong: Hard disk contents are considered non-volatile storage, meaning the data persists even when the system loses power. This characteristic makes hard drives a lower priority for immediate capture at a live crime scene compared to volatile memory components. While crucial for long-term storage of files, operating system data, and user information, the data on a hard disk will not be lost simply by shutting down the system, allowing for a more deliberate and forensically sound acquisition process later.

Network connections

Why wrong: Network connections, including active sessions, open ports, and routing tables, represent volatile data that can change rapidly or be terminated. While important for understanding communication patterns and external interactions, they are generally less volatile than the CPU's internal state. The information related to network connections, such as active sockets or established sessions, can persist for some time, but capturing the CPU's immediate execution context is a higher priority because it directly reflects the system's current processing activity.

BCP deals with natural disasters, DRP deals with cyberattacks

Why wrong: This statement incorrectly limits the scope of Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP) to specific threat categories. Both BCP and DRP are designed to address a wide array of disruptive events, encompassing natural disasters, cyberattacks, human error, infrastructure failures, and pandemics. Their effectiveness lies in their ability to provide resilience regardless of the incident's origin, focusing on impact rather than solely on the cause of the disruption.

BCP is for IT systems, DRP is for business processes

Why wrong: This option reverses the fundamental scopes of Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP). BCP is an overarching program focused on maintaining critical business processes and functions during and after a disruption, ensuring the organization can continue its mission. Conversely, DRP specifically targets the recovery and restoration of an organization's information technology (IT) systems, infrastructure, and data, which are essential enablers for those business processes.

BCP is a subset of DRP

Why wrong: Stating that Business Continuity Planning (BCP) is a subset of Disaster Recovery Planning (DRP) fundamentally misunderstands their hierarchical relationship. BCP is the comprehensive strategic framework that ensures the entire organization's continued operation during and after a significant disruption, encompassing all aspects including people, facilities, and processes. DRP, focused specifically on the recovery of IT infrastructure and data, is typically a critical component or subset *of* the broader BCP program, providing the technological foundation for business continuity.

Vulnerability scanner

Why wrong: A vulnerability scanner systematically identifies security weaknesses, misconfigurations, and known vulnerabilities in systems, applications, and networks. While crucial for proactive security posture management and providing data for risk assessment, its primary function is assessment and reporting. It does not possess the capabilities to automate or orchestrate real-time incident response actions based on correlated events from a SIEM.

Endpoint detection and response (EDR)

Why wrong: Endpoint Detection and Response (EDR) solutions continuously monitor and collect data from individual endpoints to detect and investigate suspicious activities and threats at that specific device level. While EDR provides critical visibility and localized response capabilities, such as isolating a compromised device or terminating a malicious process, its focus is primarily on the endpoint itself rather than providing the broader orchestration and automation across diverse security tools and systems needed for comprehensive response to correlated SIEM events.

Network-based IDS

Why wrong: A Network-based Intrusion Detection System (NIDS) monitors network traffic for signatures of known attacks or anomalous behavior, generating alerts when potential intrusions are detected. While essential for threat detection and feeding valuable event data to a SIEM, an NIDS is fundamentally a passive monitoring and alerting tool. It does not inherently possess the capabilities to automate or orchestrate active response actions across various security controls based on the broader context provided by correlated SIEM events.

Classification-based DLP

Why wrong: Classification-based DLP is not a distinct type of DLP solution but rather a fundamental capability or methodology employed *by* DLP solutions. It involves identifying sensitive data through predefined labels, patterns (e.g., regex for PII), or content analysis, which then informs the enforcement policies of network, endpoint, or cloud DLP systems. Therefore, it describes *how* data is identified, not *where* the DLP operates.

Cloud DLP

Why wrong: Cloud DLP specifically targets data residing within or transiting to/from cloud environments, such as Software-as-a-Service (SaaS) applications, Infrastructure-as-a-Service (IaaS) storage, or Platform-as-a-Service (PaaS) databases. It integrates with cloud service providers' APIs or acts as a Cloud Access Security Broker (CASB) to enforce policies on data stored in or shared via cloud services, rather than monitoring general on-premise network traffic.

Endpoint DLP

Why wrong: Endpoint DLP operates by installing agents directly on user workstations, laptops, servers, or mobile devices. These agents monitor and control data interactions at the source, such as copying files to USB drives, printing documents, uploading to personal cloud storage, or transferring data via local applications. Its primary focus is preventing data loss directly from the device itself, irrespective of network connectivity.

Verification

Why wrong: Verification is a crucial step that follows the actual implementation of fixes. Its purpose is to confirm that the applied remediation measures have effectively eliminated or mitigated the identified vulnerabilities and have not introduced new issues. Therefore, verification cannot be the immediate next step after prioritization, as there must first be something to verify, which is the remediation itself.

Reporting

Why wrong: While reporting is an essential component of the vulnerability management lifecycle, it typically occurs after remediation and subsequent verification. Initial reports might highlight identified vulnerabilities and their prioritization, but comprehensive reporting on the status of resolution and the effectiveness of controls is performed once remediation actions have been completed and confirmed. It is not the direct operational step immediately following prioritization.

Risk acceptance

Why wrong: Risk acceptance is a deliberate management decision to acknowledge a risk and take no action to reduce its likelihood or impact, often due to the cost of remediation outweighing the potential harm, or if the risk falls within an organization's acceptable threshold. While it is a valid risk response strategy, it is an alternative to remediation, not a subsequent step in the process of actively fixing vulnerabilities after they have been prioritized for action.

MTTR

Why wrong: MTTR, or Mean Time To Repair, measures the average time required to repair a failed system or component and restore it to full operational status. While crucial for assessing system maintainability and the efficiency of recovery processes, it does not quantify the maximum acceptable amount of data loss. Therefore, MTTR is unrelated to determining how much data an organization can afford to lose in a disaster.

RTO

Why wrong: RTO, or Recovery Time Objective, specifies the maximum acceptable duration of time that an application, system, or process can be unavailable after a disaster before causing unacceptable damage to the business. It focuses on the speed of restoration and the time taken to bring systems back online. RTO is distinct from data loss, as it addresses the acceptable downtime rather than the quantity of lost data.

MTD

Why wrong: MTD, or Maximum Tolerable Downtime (also known as Maximum Tolerable Period of Disruption), represents the absolute longest period a business process can be inoperative without causing irreparable harm to the organization. This metric encompasses both the RTO and any additional time for manual workarounds or degraded operations. MTD is a broader business-level tolerance for disruption, not a direct measure of acceptable data loss.

Project management office

Why wrong: The Project Management Office (PMO) is responsible for standardizing project-related governance processes and facilitating the sharing of resources, methodologies, and tools across an organization's projects. While projects often introduce significant changes, the PMO's mandate is to oversee the execution and success of projects themselves, not the granular approval or management of individual operational or infrastructure changes to existing systems. Their focus is on strategic project portfolio alignment and delivery.

Incident response team

Why wrong: The Incident Response Team (IRT) is a specialized group dedicated to detecting, analyzing, containing, eradicating, recovering from, and post-incident reviewing security incidents or system outages. Their primary function is reactive, focusing on restoring normal operations and mitigating harm after an event has occurred. This critical role is distinct from the proactive, planned process of evaluating and authorizing proposed changes to systems or services before they are implemented.

Security operations center

Why wrong: The Security Operations Center (SOC) is responsible for continuously monitoring an organization's information systems for security incidents, analyzing threats, and coordinating responses to protect assets. While the SOC plays a vital role in ensuring the security of systems after changes are implemented, and may provide input on security risks during the change process, its core function does not involve the formal approval, scheduling, or overall governance of the change management process itself. Their focus is on threat detection and response.

To document the tools used during investigation

Why wrong: Documenting the specific forensic tools, software, and hardware used during an investigation is a crucial aspect of maintaining a comprehensive audit trail and ensuring the reproducibility of results. However, this documentation primarily falls under the forensic methodology or investigation report, not the chain of custody. The chain of custody specifically tracks the physical and logical handling of the evidence item itself, detailing who had access, when, and for what purpose, to prevent tampering.

To identify the perpetrator of a cybercrime

Why wrong: The identification of a cybercrime perpetrator is the ultimate goal of the entire forensic investigation process, achieved through meticulous analysis of digital evidence, correlation of artifacts, and attribution techniques. The chain of custody, conversely, is a procedural control designed to safeguard the integrity and authenticity of that evidence before and during its analysis. It ensures that any findings derived from the evidence can be trusted and presented credibly in legal proceedings, rather than directly revealing the identity of the offender.

To speed up the forensic analysis process

Why wrong: Implementing a rigorous chain of custody process often involves detailed documentation, secure storage, and careful transfer protocols, which can inherently add time and administrative overhead to an investigation. Its purpose is not to accelerate the technical analysis of digital evidence, but rather to establish an unbroken, verifiable record of possession and handling for every piece of evidence. This meticulous approach prioritizes the integrity and legal defensibility of the evidence over the speed of the forensic examination itself.

Incident manager

Why wrong: The incident manager's primary responsibility is the overall coordination and strategic oversight of an incident, ensuring effective communication, resource allocation, and adherence to response plans. Their role is managerial and logistical, focusing on bringing an incident to resolution, rather than performing the hands-on technical analysis or deep digital forensics required to extract evidence from compromised systems. They direct the forensic efforts but do not execute them.

Tier 2

Why wrong: Tier 2 analysts are responsible for in-depth investigation of escalated alerts, correlating events, and executing containment and eradication procedures. While they possess strong analytical skills for incident response, their expertise typically does not extend to the highly specialized techniques of deep digital forensics, such as advanced memory analysis, file system reconstruction, or malware reverse engineering. These specialized forensic tasks often require dedicated tools and certifications beyond the scope of a typical Tier 2 role.

Tier 1

Why wrong: Tier 1 analysts serve as the first line of defense, primarily focused on monitoring security tools, validating alerts, and performing initial triage according to predefined playbooks. Their role is to quickly identify potential incidents and escalate them appropriately, lacking the necessary training, specialized tools, or authorization to conduct any form of detailed investigation or digital forensic analysis. They are not equipped for deep technical analysis.

Daily full backups

Why wrong: Daily full backups capture a complete copy of all specified data once every 24 hours. While providing a baseline for recovery, this method inherently means that up to 24 hours of data generated between the last successful backup and the ransomware attack could be permanently lost. This significant data loss window often fails to meet modern Recovery Point Objectives (RPOs) for critical systems, making it an insufficient strategy for rapid and complete recovery from sophisticated attacks.

Weekly full backups with daily differentials

Why wrong: This strategy involves a weekly full backup supplemented by daily differential backups, which only store changes since the last full backup. While more efficient than multiple full backups, recovery still requires restoring the last full backup followed by the latest differential, introducing complexity and potential for data loss up to 24 hours. This approach does not provide the necessary granularity to recover data precisely to the moment before a ransomware attack, thus failing to meet tight RPOs.

Snapshot every 4 hours

Why wrong: Taking snapshots every four hours creates discrete recovery points at fixed intervals. In the context of a ransomware attack, this means that any data changes occurring within the four-hour window between the last snapshot and the infection event would be unrecoverable. This strategy directly violates a typical stringent Recovery Point Objective (RPO) requirement, as it guarantees a potential data loss of up to four hours, which is unacceptable for critical business operations.