Security Operations practice questions

A security analyst notices repeated failed login attempts from an internal IP address on the domain controller. After enabling account lockout, the lockouts continue but the source IP changes. What is the best next step?

Trap 1: Increase the account lockout threshold

Lockout is already enabled; attackers are using different accounts or bypassing lockout via distributed attempts.

Trap 2: Ignore the event as it is likely a false positive

Repeated failed logins from multiple IPs indicate a real attack, not a false positive.

Trap 3: Disable the user account being targeted

The target account may be legitimate; disabling it could impact business operations without stopping the attack.

A
Analyze the log events to identify the attack pattern and implement additional controls such as MFA
Understanding the attack pattern allows for targeted controls like requiring MFA for the targeted account or blocking the attack vector.
B
Increase the account lockout threshold
Why wrong: Lockout is already enabled; attackers are using different accounts or bypassing lockout via distributed attempts.
C
Ignore the event as it is likely a false positive
Why wrong: Repeated failed logins from multiple IPs indicate a real attack, not a false positive.
D
Disable the user account being targeted
Why wrong: The target account may be legitimate; disabling it could impact business operations without stopping the attack.

Read the full NAT/PAT explanation →

Question 2hardmultiple choice

A SOC analyst receives an alert for a suspicious outbound connection from a server in the DMZ to an external IP on port 443. The server is a web application server that should only communicate internally. The analyst checks the process and finds it is 'svchost.exe' running from a non-standard path. What is the most appropriate immediate action?

Trap 1: Initiate a full incident response investigation

While necessary, immediate containment should precede full investigation to limit impact.

Trap 2: Disregard the alert because svchost.exe is a legitimate Windows…

svchost.exe is legitimate, but running from a non-standard path is a strong indicator of compromise.

Trap 3: Terminate the suspicious process

Terminating the process may stop the current connection, but the malware could restart or other components may remain.

A
Isolate the server from the network
Isolation stops the malicious outbound connection and prevents further damage, allowing for later forensic analysis.
B
Initiate a full incident response investigation
Why wrong: While necessary, immediate containment should precede full investigation to limit impact.
C
Disregard the alert because svchost.exe is a legitimate Windows process
Why wrong: svchost.exe is legitimate, but running from a non-standard path is a strong indicator of compromise.
D
Terminate the suspicious process
Why wrong: Terminating the process may stop the current connection, but the malware could restart or other components may remain.

Question 3easymultiple choice

During a security audit, an organization discovers that several employees are sharing a single generic account to access a critical database. Which principle of security operations is being violated?

Trap 1: Separation of duties

Separation of duties ensures no single person has excessive control, but account sharing is a different issue.

Trap 2: Defense in depth

Defense in depth is a layered security approach, not directly related to account sharing.

Trap 3: Least privilege

Least privilege is about granting minimal permissions, not about account sharing.

A
Accountability
Account sharing removes the ability to trace actions to an individual, violating accountability.
B
Separation of duties
Why wrong: Separation of duties ensures no single person has excessive control, but account sharing is a different issue.
C
Defense in depth
Why wrong: Defense in depth is a layered security approach, not directly related to account sharing.
D
Least privilege
Why wrong: Least privilege is about granting minimal permissions, not about account sharing.

Question 4hardmultiple choice

A security engineer is designing a new SIEM correlation rule to detect potential data exfiltration. The rule should trigger when a single internal host sends more than 10 MB of data to an external IP address within a 5-minute window, but only if the external IP is not on a whitelist of known business partners. Which approach best minimizes false positives while ensuring effective detection?

Trap 1: Apply the rule to all internal hosts with the same threshold

A uniform threshold will cause false positives for hosts that normally transfer large amounts of data.

Trap 2: Trigger only when the destination IP is in a threat intelligence…

This would miss exfiltration to unknown or new malicious IPs not yet in the feed.

Trap 3: Set a static threshold of 10 MB for all hosts, but exclude traffic…

Static thresholds do not adapt to individual host baselines, and excluding cloud providers may miss exfiltration via those services.

A
Apply the rule to all internal hosts with the same threshold
Why wrong: A uniform threshold will cause false positives for hosts that normally transfer large amounts of data.
B
Trigger only when the destination IP is in a threat intelligence feed of known malicious IPs
Why wrong: This would miss exfiltration to unknown or new malicious IPs not yet in the feed.
C
Use a baseline of normal traffic per host and trigger only when the volume exceeds the baseline by a significant margin
Baselines allow the rule to adapt to each host's typical behavior, reducing false positives while detecting anomalies.
D
Set a static threshold of 10 MB for all hosts, but exclude traffic to common cloud storage providers
Why wrong: Static thresholds do not adapt to individual host baselines, and excluding cloud providers may miss exfiltration via those services.

Question 5easymultiple choice

A company's security policy requires that all removable media be encrypted. An employee plugs in a USB drive and is prompted to format it before use. After formatting, the drive is not encrypted. What is the most likely reason?

Trap 1: The USB drive hardware does not support encryption

Encryption can be implemented in software regardless of hardware support.

Trap 2: The operating system does not support encryption of removable media

Most modern OSes support encryption of removable media.

Trap 3: The employee used the wrong file system (FAT32 vs NTFS)

File system choice does not provide encryption.

A
The employee did not enable encryption (e.g., BitLocker To Go) after formatting
Encryption is a separate step that must be explicitly enabled, e.g., via BitLocker To Go.
B
The USB drive hardware does not support encryption
Why wrong: Encryption can be implemented in software regardless of hardware support.
C
The operating system does not support encryption of removable media
Why wrong: Most modern OSes support encryption of removable media.
D
The employee used the wrong file system (FAT32 vs NTFS)
Why wrong: File system choice does not provide encryption.

Question 6mediummultiple choice

An organization is implementing a new backup strategy for its critical servers. The backup must support rapid restoration of individual files and allow for a recovery point objective (RPO) of no more than 15 minutes. Which backup method should be used for daily operations?

Trap 1: Full backup every 24 hours

Full backups only capture data once per day, so RPO could be up to 24 hours.

Trap 2: Differential backup every 6 hours

Differential backups also have a 6-hour RPO, too high.

Trap 3: Incremental backup every 4 hours

Even with 4-hour increments, RPO could be up to 4 hours, exceeding 15 minutes.

A
Full backup every 24 hours
Why wrong: Full backups only capture data once per day, so RPO could be up to 24 hours.
B
Continuous data protection (CDP)
CDP captures every write, enabling restoration to any point within seconds, meeting the RPO.
C
Differential backup every 6 hours
Why wrong: Differential backups also have a 6-hour RPO, too high.
D
Incremental backup every 4 hours
Why wrong: Even with 4-hour increments, RPO could be up to 4 hours, exceeding 15 minutes.

Read the full NAT/PAT explanation →

Question 7mediummultiple choice

During a vulnerability scan, a security analyst discovers that a web server is running an outdated version of Apache with known remote code execution vulnerabilities. The server is in production and cannot be patched immediately due to dependency conflicts. What is the best compensating control to reduce risk while a permanent fix is developed?

Trap 1: Disable all unnecessary modules and services on the server

Reducing attack surface is good practice but does not address the known vulnerability.

Trap 2: Enable detailed logging and alerting for the server

Logging helps detect attacks but does not prevent them.

Trap 3: Isolate the server in a separate VLAN with strict ACLs

Segmentation helps but does not prevent exploitation of the vulnerability if the server is still accessible.

A
Disable all unnecessary modules and services on the server
Why wrong: Reducing attack surface is good practice but does not address the known vulnerability.
B
Implement a web application firewall (WAF) to block known attack patterns
A WAF can detect and block exploit attempts, providing virtual patching until the software is updated.
C
Enable detailed logging and alerting for the server
Why wrong: Logging helps detect attacks but does not prevent them.
D
Isolate the server in a separate VLAN with strict ACLs
Why wrong: Segmentation helps but does not prevent exploitation of the vulnerability if the server is still accessible.

Question 8hardmulti select

Which TWO of the following are essential components of a successful security awareness program?

Trap 1: Implementation of technical controls like antivirus

Technical controls are part of security operations, not the awareness program itself.

Trap 2: Annual one-time training sessions

One-time training is not effective for long-term behavior change.

Trap 3: Punitive measures for security violations

Punishment can discourage reporting and create a negative environment.

A
Metrics to measure the program's effectiveness
Measuring outcomes (e.g., phishing test results) allows refinement of the program.
B
Implementation of technical controls like antivirus
Why wrong: Technical controls are part of security operations, not the awareness program itself.
C
Annual one-time training sessions
Why wrong: One-time training is not effective for long-term behavior change.
D
Punitive measures for security violations
Why wrong: Punishment can discourage reporting and create a negative environment.
E
Regular, engaging, and role-specific training
Frequent, tailored training keeps security top-of-mind and addresses specific risks.

Question 9mediummulti select

Which THREE of the following are best practices for securing a data center's physical access?

Trap 1: Use only biometric readers for all doors

Biometrics alone are single-factor and can be spoofed or have false rejects.

Trap 2: Allow visitors to access the lobby without an escort

Visitors should always be escorted or signed in.

A
Implement multi-factor authentication at entry points
Combining something you know, have, or are increases security.
B
Install a mantrap at the main entrance
Mantraps prevent unauthorized individuals from following authorized personnel.
C
Use only biometric readers for all doors
Why wrong: Biometrics alone are single-factor and can be spoofed or have false rejects.
D
Allow visitors to access the lobby without an escort
Why wrong: Visitors should always be escorted or signed in.
E
Use CCTV with retention policies for monitoring
CCTV provides surveillance and evidence for incidents.

Question 10easymulti select

Which TWO of the following are valid reasons for conducting a business impact analysis (BIA)?

Trap 1: To identify vulnerabilities in the network infrastructure

Vulnerability identification is part of risk assessment, not BIA.

Trap 2: To perform a full security audit of the organization

A security audit is broader and not the purpose of a BIA.

Trap 3: To create a list of all hardware and software assets

Asset inventory is a separate process.

A
To identify vulnerabilities in the network infrastructure
Why wrong: Vulnerability identification is part of risk assessment, not BIA.
B
To perform a full security audit of the organization
Why wrong: A security audit is broader and not the purpose of a BIA.
C
To create a list of all hardware and software assets
Why wrong: Asset inventory is a separate process.
D
To identify critical business processes and their dependencies
The BIA identifies which processes are most important to the organization.
E
To determine the maximum acceptable outage time for each process
The BIA helps define RTOs and RPOs.

Question 11mediummultiple choice

A network administrator finds the above log entry. The source IP 192.168.1.10 is a user workstation. What does this log entry indicate?

Exhibit

Refer to the exhibit.

Exhibit: syslog entry from a firewall
<134>2024-03-15T14:23:45Z FW-01 %ASA-4-106023: Deny tcp src inside:192.168.1.10/3345 dst outside:203.0.113.5/80 by access-group "OUTSIDE_IN" [0x0, 0x0]

Trap 1: An external host attempted to connect to the workstation on port 80

The source is inside and destination is outside; it's outbound traffic.

Trap 2: The firewall detected an intrusion attempt from the workstation

The log is a standard ACL deny, not an intrusion detection signature.

Trap 3: The workstation successfully connected to a web server on the…

The action is 'Deny', so the connection was blocked.

A
An external host attempted to connect to the workstation on port 80
Why wrong: The source is inside and destination is outside; it's outbound traffic.
B
The firewall detected an intrusion attempt from the workstation
Why wrong: The log is a standard ACL deny, not an intrusion detection signature.
C
The workstation attempted to access a web server on the internet and the traffic was blocked by an inbound ACL
The ACL 'OUTSIDE_IN' is applied to the outside interface and denied the traffic.
D
The workstation successfully connected to a web server on the internet
Why wrong: The action is 'Deny', so the connection was blocked.

Question 12hardmultiple choice

An AWS security engineer is reviewing the above S3 bucket policy. What is the net effect of this policy on requests to read objects in the 'confidential' folder?

Exhibit

Refer to the exhibit.

Exhibit: snippet from a security policy in JSON format
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    },
    {
      "Effect": "Deny",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::example-bucket/confidential/*",
      "Condition": {
        "NotIpAddress": {
          "aws:SourceIp": "10.100.0.0/16"
        }
      }
    }
  ]
}

Trap 1: Only IPs in 10.0.0.0/8 but outside 10.100.0.0/16 can read…

Those IPs are denied by the Deny statement.

Trap 2: No IPs can read confidential objects because the Deny applies to all

The Deny only applies to IPs not in 10.100.0.0/16, so those in that range can read.

Trap 3: All IPs in the 10.0.0.0/8 range can read confidential objects

The Deny statement restricts access to only 10.100.0.0/16, overriding the Allow.

A
Only IPs in 10.0.0.0/8 but outside 10.100.0.0/16 can read confidential objects
Why wrong: Those IPs are denied by the Deny statement.
B
No IPs can read confidential objects because the Deny applies to all
Why wrong: The Deny only applies to IPs not in 10.100.0.0/16, so those in that range can read.
C
All IPs in the 10.0.0.0/8 range can read confidential objects
Why wrong: The Deny statement restricts access to only 10.100.0.0/16, overriding the Allow.
D
Only IPs in 10.100.0.0/16 can read confidential objects
The Deny statement allows only IPs in 10.100.0.0/16 (since NotIpAddress denies others), and the Allow gives GetObject permission but is overridden for others.

Read the full NAT/PAT explanation →

Question 13mediummultiple choice

You are a security analyst at a financial institution. The company has a hybrid infrastructure with on-premises servers and AWS cloud. The on-premises network uses a SIEM that aggregates logs from all sources. Recently, the SIEM has been generating a high volume of alerts for failed SSH login attempts from an internal IP (10.10.50.100) to multiple Linux servers. The IP belongs to a jump box used by system administrators. Upon investigation, you find that the jump box is running a hardened OS, and only authorized admins can access it via SSH key authentication. However, the failed login attempts show usernames like 'root', 'admin', 'test', which are not valid accounts on the target servers. The attempts occur every 5 seconds around the clock. There are no successful logins from that IP. The jump box has the latest patches and antivirus. What should you do FIRST?

Trap 1: Add the usernames 'root', 'admin', 'test' to the target servers'…

This does not address the source; the attacker could use other usernames.

Trap 2: Ignore the alerts because the usernames are invalid and the jump…

Ignoring could allow the attacker to eventually compromise a server if they find a valid username.

Trap 3: Run a full antivirus scan on the jump box and check for malware

Scanning is important but containment should come first to prevent further damage.

A
Add the usernames 'root', 'admin', 'test' to the target servers' password blacklist
Why wrong: This does not address the source; the attacker could use other usernames.
B
Isolate the jump box from the network immediately and conduct a forensic analysis
The jump box is likely compromised; isolating it stops the attack and allows for investigation.
C
Ignore the alerts because the usernames are invalid and the jump box is hardened
Why wrong: Ignoring could allow the attacker to eventually compromise a server if they find a valid username.
D
Run a full antivirus scan on the jump box and check for malware
Why wrong: Scanning is important but containment should come first to prevent further damage.

Question 14mediumdrag order

Drag and drop the steps for implementing mandatory access control (MAC) in a secure system in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 15mediummatching

Match each business continuity term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Maximum acceptable downtime after a disaster

Maximum acceptable data loss measured in time

Average time between system failures

Average time to repair a failed system

Service level agreement defining performance metrics

Question 16easymultiple choice

An organization is implementing a bring-your-own-device (BYOD) policy. Which security control should be enforced to ensure that only compliant devices can access corporate resources?

Trap 1: Using a VPN concentrator

VPN concentrators don't validate device health.

Trap 2: Requiring strong passwords

Passwords don't verify device compliance.

Trap 3: Enabling full disk encryption

Encryption protects data but doesn't enforce compliance at access.

A
Using a VPN concentrator
Why wrong: VPN concentrators don't validate device health.
B
Requiring strong passwords
Why wrong: Passwords don't verify device compliance.
C
Implementing network access control (NAC)
NAC checks device posture before network access.
D
Enabling full disk encryption
Why wrong: Encryption protects data but doesn't enforce compliance at access.

Question 17mediummultiple choice

During a security incident, the incident response team identifies that an attacker exfiltrated data via a compromised service account. Which of the following is the BEST immediate step to contain the incident?

Trap 1: Notify law enforcement

Law enforcement is notified after containment.

Trap 2: Enable detailed auditing on the account

Auditing helps investigation but doesn't contain.

Trap 3: Change the password of the service account

Password change might not close all access paths.

A
Notify law enforcement
Why wrong: Law enforcement is notified after containment.
B
Enable detailed auditing on the account
Why wrong: Auditing helps investigation but doesn't contain.
C
Revoke the service account's privileges
Revoking privileges immediately stops unauthorized access.
D
Change the password of the service account
Why wrong: Password change might not close all access paths.

Question 18hardmultiple choice

A security analyst observes repeated failed logon attempts from a single IP address against a domain controller. The account lockout policy is set to 5 attempts within 30 minutes. However, after the account is locked, the attack switches to a different username. Which type of attack is most likely occurring?

Trap 1: Brute-force attack

Brute-force would lock the target account.

Trap 2: Dictionary attack

Dictionary attack also targets a single account.

Trap 3: Rainbow table attack

Rainbow tables are used offline, not for login attempts.

A
Password spraying attack
Password spraying tries common passwords across many accounts.
B
Brute-force attack
Why wrong: Brute-force would lock the target account.
C
Dictionary attack
Why wrong: Dictionary attack also targets a single account.
D
Rainbow table attack
Why wrong: Rainbow tables are used offline, not for login attempts.

Question 19easymultiple choice

An organization needs to ensure that backup tapes containing sensitive data are protected during transportation between sites. What is the most effective control?

Trap 1: Applying tamper-evident seals

Seals show opening but don't prevent data access.

Trap 2: Using a chain of custody log

Logs don't protect data confidentiality.

Trap 3: Using a bonded courier service

Bonded courier reduces theft risk but not data exposure.

A
Applying tamper-evident seals
Why wrong: Seals show opening but don't prevent data access.
B
Encrypting the backup tapes
Encryption protects data at rest in transit.
C
Using a chain of custody log
Why wrong: Logs don't protect data confidentiality.
D
Using a bonded courier service
Why wrong: Bonded courier reduces theft risk but not data exposure.

Question 20mediummultiple choice

A company is designing a recovery site for its critical database. The recovery time objective (RTO) is 2 hours, and the recovery point objective (RPO) is 15 minutes. Which of the following replication strategies is BEST suited?

Trap 1: Asynchronous replication to a warm site

Async replication may exceed RPO.

Trap 2: Full backups every 24 hours to a cold site

RPO too long.

Trap 3: Weekly snapshots to a warm site

RPO inadequate.

A
Asynchronous replication to a warm site
Why wrong: Async replication may exceed RPO.
B
Full backups every 24 hours to a cold site
Why wrong: RPO too long.
C
Weekly snapshots to a warm site
Why wrong: RPO inadequate.
D
Synchronous replication to a hot site
Sync replication meets RPO and RTO.