I85PREP
⌘ K
Cisco CyberOps Professional study materials
Cisco CyberOps Professional study resources

Cisco CyberOps Professional practice questions

One question at a time. Build your Cisco CyberOps Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Operations Fundamentals

In the Cisco CyberOps operational model, which team or function is primarily accountable for continuously monitoring security alerts, triaging them, and escalating confirmed incidents?

  1. The enterprise architecture group that designs network segmentation
  2. The change advisory board that approves production changes
  3. The SOC analyst tier responsible for alert triage and escalation Correct answer.
  4. The vulnerability management team that schedules patch windows

Explanation

The security operations center is the function built around continuous monitoring, alert triage, and escalation of confirmed incidents to incident response. Architecture, change management, and vulnerability management are adjacent functions that feed the SOC but do not own live alert triage.

Question 2Security Operations Fundamentals

Which data source provides the most authoritative record of authentication events across multiple systems for a SOC investigation?

  1. NetFlow records collected at the border router
  2. DHCP lease databases
  3. Firewall session table exports
  4. Centralized authentication logs from directory and RADIUS services Correct answer.

Explanation

Directory service and RADIUS logs record who authenticated, from where, and whether the attempt succeeded, making them the authoritative authentication record. The other sources describe network behavior or address assignment rather than identity verification.

Question 3Security Operations Fundamentals

An analyst needs a metric that expresses how quickly the SOC begins investigating a validated alert after it is generated. Which metric matches this requirement?

  1. Mean time to detect
  2. Mean time to acknowledge Correct answer.
  3. Alert false positive rate
  4. Mean time to remediate

Explanation

Mean time to acknowledge measures the interval between alert generation and analyst acknowledgement or start of investigation. Detection time ends when the alert fires, and remediation time covers containment through closure.

Question 4Security Operations Fundamentals

What is the primary purpose of a security baseline in operations?

  1. To record the incident timeline for post-incident review
  2. To list every vulnerability discovered during the last quarter
  3. To define the approved configuration state against which drift can be measured Correct answer.
  4. To document the SOC shift roster and escalation contacts

Explanation

A baseline captures the approved configuration of a system so that deviations, whether accidental or malicious, can be detected and corrected. Vulnerability lists, incident timelines, and staffing documents serve different operational purposes.

Question 5Security Operations Fundamentals

Which element of the CIA triad is most directly affected when an attacker modifies records in a billing database without being detected?

  1. Non-repudiation
  2. Integrity Correct answer.
  3. Availability
  4. Confidentiality

Explanation

Integrity concerns the accuracy and completeness of data, so unauthorized modification of billing records is an integrity failure. Confidentiality would involve disclosure and availability would involve loss of access.

Question 6Security Operations Fundamentals

In the context of security operations, what distinguishes a security event from an incident?

  1. An incident is logged by network devices, while an event is logged only by endpoints
  2. An event requires executive notification, while an incident does not
  3. An event is any observable occurrence, while an incident is an event that actually or potentially harms the organization Correct answer.
  4. An event is always malicious, while an incident may be benign

Explanation

An event is simply an observable occurrence in a system or network; an incident is a subset of events judged to have actual or potential negative impact. This distinction drives escalation criteria in the SOC.

Question 7Security Operations Fundamentals

Which activity belongs to the containment phase of the incident response lifecycle rather than to detection?

  1. Reviewing threat intelligence feeds for indicators
  2. Correlating IDS alerts with proxy logs
  3. Tuning a SIEM rule to reduce noise
  4. Isolating an infected host from the production VLAN Correct answer.

Explanation

Containment limits the spread and impact of an incident, and isolating a compromised host is a canonical containment action. Correlation, intelligence review, and rule tuning are detection and monitoring activities.

Question 8Security Operations Fundamentals

Why is time synchronization across log sources important in security operations?

  1. It reduces the storage footprint of raw log data
  2. It allows events from different systems to be correlated into a reliable timeline Correct answer.
  3. It encrypts log traffic between collectors and the SIEM
  4. It prevents attackers from spoofing source IP addresses

Explanation

Accurate, consistent timestamps let analysts order events across heterogeneous sources and reconstruct an attack sequence. Without synchronization, correlation and forensic timelines become unreliable.

Question 9Security Operations Fundamentals

A SOC wants alerts generated only when a privileged account is used outside approved maintenance windows. Which detection approach best fits?

  1. Vulnerability scanning of privileged hosts
  2. Signature matching on known malware hashes
  3. Full packet capture retained for thirty days
  4. Behavioral rule correlating account privilege with time-of-day context Correct answer.

Explanation

This requirement is contextual: it depends on account privilege and time of use, which a behavioral or correlation rule can express. Hash signatures, packet capture, and scanning do not evaluate usage context.

Question 10Security Operations Fundamentals

An analyst observes a workstation resolving many random-looking subdomains under a single parent domain at regular short intervals. Which threat behavior does this most likely indicate?

  1. A brute force attack against the local account database
  2. DNS tunneling or domain generation algorithm activity Correct answer.
  3. ARP cache poisoning on the local segment
  4. A BGP route hijack affecting the site

Explanation

High-volume queries for algorithmically generated or random subdomains are characteristic of DGA beaconing or DNS tunneling used for command and control or exfiltration. ARP poisoning, local brute force, and BGP hijacking produce different observable patterns.

Question 11Security Operations Fundamentals

Which control type is a security awareness training program?

  1. Preventive technical control
  2. Physical control
  3. Detective technical control
  4. Administrative control Correct answer.

Explanation

Training is a management or administrative control because it changes human behavior through policy, process, and education rather than through technology or physical barriers. Technical and physical controls operate on systems and facilities.

Question 12Security Operations Fundamentals

A SIEM rule fires hundreds of times daily on the same benign administrative script. What is the most appropriate operational response?

  1. Escalate every alert to incident response to be safe
  2. Add a documented tuning exception or suppression with review date Correct answer.
  3. Raise the rule severity so analysts notice it faster
  4. Disable the entire log source to eliminate the alerts

Explanation

Recurring benign alerts should be tuned through documented exceptions or suppressions that are reviewed periodically, preserving visibility while reducing noise. Disabling the source or escalating everything degrades detection, and raising severity worsens the noise problem.

Question 13Security Operations Fundamentals

During triage, an analyst finds a host communicating with a known command-and-control IP from a threat feed. Which enrichment step most improves the analyst's decision quality?

  1. Checking the host's asset criticality and the process making the connection Correct answer.
  2. Rebooting the host immediately to clear the connection
  3. Deleting the firewall logs for the host
  4. Waiting for the next scheduled vulnerability scan

Explanation

Combining the indicator hit with asset criticality and the responsible process tells the analyst whether the activity is high-impact and whether it is likely malicious. Immediate reboot risks destroying evidence, and deleting logs or waiting for a scan delays and degrades response.

Question 14Security Operations Fundamentals

Which statement best describes the role of threat intelligence in security operations?

  1. It is only useful for regulatory reporting
  2. It guarantees that known threats are blocked at the perimeter
  3. It provides context about adversaries and indicators that informs detection and prioritization Correct answer.
  4. It replaces the need for log collection in the SOC

Explanation

Threat intelligence supplies context such as adversary behavior, infrastructure, and indicators that helps analysts prioritize and interpret detections. It complements log collection and controls but does not replace or guarantee anything.

Question 15Security Operations Fundamentals

A SOC is defining escalation criteria. Which condition most clearly warrants escalation from tier one to tier two?

  1. A scheduled software update notification
  2. A confirmed indicator match on a domain controller with anomalous outbound traffic Correct answer.
  3. A user reporting a slow application
  4. A single failed login from an internal workstation

Explanation

A confirmed indicator on a high-value asset combined with anomalous outbound traffic indicates likely compromise with significant impact, justifying escalation. The other conditions are routine and can be handled through standard procedures.

Question 16Security Operations Fundamentals

What is the operational benefit of network segmentation for security monitoring?

  1. It reduces the number of devices requiring logging
  2. It encrypts all east-west traffic automatically
  3. It eliminates the need for endpoint detection agents
  4. It creates choke points where inter-zone traffic can be inspected and policy violations detected Correct answer.

Explanation

Segmentation concentrates traffic between zones at enforcement and inspection points, making anomalous cross-zone flows easier to detect and control. It does not reduce logging needs, replace endpoint agents, or automatically encrypt traffic.

Question 17Security Operations Fundamentals

An analyst receives an alert for a large outbound transfer to an unfamiliar cloud storage provider. Which additional evidence best helps distinguish sanctioned backup activity from exfiltration?

  1. The destination IP geolocation alone
  2. The process owner, data volume trend, and whether the destination is on the approved service list Correct answer.
  3. The host's operating system version
  4. The number of DNS queries made by the host

Explanation

Determining intent requires knowing which process initiated the transfer, whether the volume deviates from baseline, and whether the destination is sanctioned. Geolocation, query counts, and OS version alone cannot distinguish backup from exfiltration.

Question 18Security Operations Fundamentals

Which practice best supports evidence integrity during incident response?

  1. Storing evidence on the compromised host for convenience
  2. Documenting a chain of custody and hashing acquired images Correct answer.
  3. Relying on memory of the responders instead of written records
  4. Allowing analysts to modify evidence freely for faster analysis

Explanation

Chain of custody records who handled evidence and when, while hashing demonstrates that acquired data has not changed. Together they preserve admissibility and analytical trustworthiness.

Question 19Security Operations Fundamentals

A SOC wants to measure whether its detection content is effective over time. Which pair of metrics best supports that goal?

  1. Number of analysts and number of shifts
  2. Count of open tickets and count of closed tickets
  3. Number of firewall rules and number of VLANs
  4. True positive rate and mean time to detect for known scenarios Correct answer.

Explanation

Detection effectiveness combines how often real malicious activity is caught and how quickly it is caught. Infrastructure counts, ticket throughput, and staffing levels describe capacity rather than detection quality.

Question 20Security Operations Fundamentals

Which scenario best illustrates the concept of a false positive in security monitoring?

  1. A benign administrative tool triggers a malware alert Correct answer.
  2. A malicious login is detected and correctly escalated
  3. A malicious login goes undetected
  4. An alert is suppressed after documented tuning

Explanation

A false positive occurs when a detection fires on activity that is not actually malicious. Correctly escalated true positives and missed detections describe different outcomes, and a documented suppression is a tuning action.

Question 21Security Operations Fundamentals

An analyst must determine whether a suspicious binary executed on a server before or after a configuration change. Which data source combination answers this most directly?

  1. Email gateway logs and spam quarantine reports
  2. Process execution logs and configuration change records with synchronized timestamps Correct answer.
  3. NetFlow records and DHCP leases
  4. Wireless controller logs and badge access logs

Explanation

Process execution telemetry establishes when the binary ran, and change records establish when the configuration changed; synchronized timestamps allow ordering. The other combinations lack either execution or change evidence.

Question 22Security Operations Fundamentals

A SOC observes periodic outbound connections every 60 seconds with small payloads to a rotating set of rare domains, using a legitimate signed binary. Which conclusion is most defensible?

  1. The pattern is normal because the binary is digitally signed
  2. The pattern indicates beaconing through living-off-the-land techniques and warrants investigation Correct answer.
  3. The pattern can be ignored because payloads are small
  4. The pattern proves the host is fully compromised and data has been exfiltrated

Explanation

Regular low-volume connections to rotating rare domains via a signed system binary match beaconing and living-off-the-land behavior, which justifies investigation. It does not prove exfiltration, and signing or small payload size does not establish benign intent.

Question 23Security Operations Fundamentals

Which approach best reduces alert fatigue without weakening detection coverage in a mature SOC?

  1. Adding more log sources without tuning
  2. Increasing the retention period for raw logs
  3. Risk-based alert prioritization combined with periodic rule efficacy review Correct answer.
  4. Disabling high-volume rules permanently

Explanation

Prioritizing alerts by risk focuses analyst attention where impact is greatest, and periodic efficacy review removes or refines rules that no longer add value. Disabling rules, extending retention, or adding untuned sources does not improve signal quality.

Question 24Security Operations Fundamentals

An incident responder finds that an attacker used valid credentials and only sanctioned administrative tools. Which detection strategy is most likely to reveal this activity?

  1. Blocking all outbound traffic at the perimeter
  2. User and entity behavior analytics baselining normal administrative patterns Correct answer.
  3. Hash-based antivirus scanning of user directories
  4. Quarterly external penetration testing

Explanation

When credentials are valid and tools are sanctioned, signature and perimeter controls see nothing unusual; behavioral baselining detects deviations such as atypical hours, hosts, or volumes. Antivirus, blanket blocking, and periodic testing would not surface the anomaly.

Question 25Security Operations Fundamentals

A SOC must justify staffing and tooling investment to leadership. Which evidence set is most persuasive for that audience?

  1. The number of vulnerability scan findings per host
  2. Trend data linking detection coverage, response times, and incidents prevented or contained Correct answer.
  3. A list of all SIEM correlation rule names
  4. Detailed packet captures from last week

Explanation

Leadership decisions depend on outcome-oriented trends that connect operational capability to risk reduction, such as coverage, response time, and incidents contained. Raw captures, rule inventories, and per-host findings are technical detail without a business narrative.

Question 26Security Operations Fundamentals

Which statement accurately describes a security information and event management (SIEM) system's core function in a security operations center (SOC)?

  1. It manages user identities and controls access to enterprise applications.
  2. It enforces endpoint antivirus signatures and blocks malicious file execution.
  3. It aggregates and correlates log data from multiple sources to generate actionable alerts. Correct answer.
  4. It provides full packet capture and deep packet inspection for all network traffic.

Explanation

A SIEM collects logs from diverse sources, normalizes and correlates them, and applies rules to surface alerts for analysts. Endpoint protection, full packet capture, and identity management are functions of other tools, not the SIEM's core role.

Question 27Security Operations Fundamentals

A SOC analyst notices that a detection rule triggers every time the backup service account logs on, which happens nightly at 02:00. The activity is expected. What is the most appropriate operational action?

  1. Add a suppression or tuning condition to exclude the known backup window and account. Correct answer.
  2. Escalate every trigger to tier two for manual review.
  3. Increase the rule's severity to ensure it is not missed.
  4. Disable the rule permanently to eliminate the noise.

Explanation

Tuning a rule to suppress known-good behavior, such as a scheduled backup, reduces false positives without removing detection for anomalous use of the account. Disabling the rule entirely or escalating expected activity wastes resources and weakens coverage.

Question 28Security Operations Fundamentals

Which type of control is a security awareness training program?

  1. Preventive
  2. Detective
  3. Administrative Correct answer.
  4. Corrective

Explanation

Security awareness training is an administrative control because it relies on policies, procedures, and human behavior rather than technical enforcement. Preventive, detective, and corrective describe the control's function, not its category; training is primarily administrative.

Question 29Security Operations Fundamentals

During incident response, which action best preserves the integrity of volatile evidence on a compromised workstation?

  1. Capture memory and running process information before powering down. Correct answer.
  2. Immediately reimage the disk to restore a known-good state.
  3. Delete suspicious files to prevent reinfection.
  4. Reboot the system to clear malicious processes before collection.

Explanation

Volatile data such as memory contents and running processes is lost on shutdown or reboot, so it must be collected first. Reimaging, rebooting, and deleting files destroy evidence and hinder root-cause analysis.

Question 30Security Operations Fundamentals

An analyst is triaging an alert and needs to determine whether a suspicious file hash has been seen in the organization before. Which data source is most directly suited to that query?

  1. The endpoint detection and response (EDR) telemetry store Correct answer.
  2. The SIEM's historical log index
  3. The threat intelligence platform (TIP)
  4. The configuration management database (CMDB)

Explanation

EDR telemetry records endpoint process and file activity, allowing analysts to search for previous occurrences of a hash across hosts. The SIEM holds logs but not typically full endpoint file execution history; a TIP provides external intelligence, and a CMDB tracks assets.

Question 31Security Operations Fundamentals

A SOC wants to reduce the mean time to detect (MTTD) for credential misuse. Which detection strategy is most effective?

  1. Baselining normal authentication behavior and alerting on anomalies such as impossible travel or unusual logon times. Correct answer.
  2. Monitoring only failed logon events across all systems.
  3. Reviewing firewall logs for blocked outbound connections.
  4. Scanning endpoints weekly for missing patches.

Explanation

Credential misuse often involves valid accounts, so baselining normal authentication patterns and detecting deviations like impossible travel or off-hours access is more effective than monitoring failures alone. Firewall logs and patch scans do not directly address authentication anomalies.

Question 32Security Operations Fundamentals

Which factor most directly determines the priority assigned to a security alert during triage?

  1. The number of log sources that contributed to the alert.
  2. The potential impact on critical assets and the confidence that the activity is malicious. Correct answer.
  3. The alert's timestamp relative to the current time.
  4. The analyst's personal familiarity with the affected system.

Explanation

Alert priority should reflect risk, which combines the potential impact on business-critical assets with the confidence that the activity represents a true threat. Timestamp, source count, and familiarity are not reliable indicators of severity.

Question 33Security Operations Fundamentals

An analyst observes a workstation making DNS queries for many random-looking subdomains under a single parent domain at a regular interval. Which technique is most likely being used?

  1. Domain fronting for censorship circumvention
  2. DNS tunneling for data exfiltration
  3. Domain generation algorithm (DGA) for command and control Correct answer.
  4. Fast flux DNS for load balancing

Explanation

A DGA produces many pseudo-random subdomains that malware queries to locate its command-and-control server, often at regular intervals. DNS tunneling typically encodes data in query payloads, fast flux rotates IP addresses, and domain fronting hides the true destination behind a CDN.

Question 34Security Operations Fundamentals

Which practice is essential for maintaining the chain of custody for digital evidence collected during an incident?

  1. Storing evidence on the analyst's local workstation for quick access.
  2. Documenting every transfer and access of evidence with timestamps and signatures. Correct answer.
  3. Compressing evidence files to save space without recording hashes.
  4. Allowing any team member to modify evidence as needed for analysis.

Explanation

Chain of custody requires a documented, auditable record of who handled evidence, when, and for what purpose, often with signatures and hashes. Local storage, unrecorded compression, and unrestricted modification compromise integrity and admissibility.

Question 35Security Operations Fundamentals

A SOC is evaluating whether a new detection rule is effective. Which metric pair best indicates that the rule is both catching real threats and not overwhelming analysts?

  1. Total alerts generated and average analyst salary.
  2. Mean time to repair and system uptime.
  3. Number of log sources integrated and rule complexity.
  4. True positive rate and false positive rate. Correct answer.

Explanation

True positive rate measures how often the rule correctly identifies malicious activity, while false positive rate measures how often it incorrectly flags benign activity. Together they show detection efficacy and operational burden; the other pairs do not directly assess rule performance.

Question 36Security Operations Fundamentals

Which activity is part of the identification phase of the incident response lifecycle?

  1. Applying a patch to close the vulnerability exploited by an attacker.
  2. Determining that a suspicious event exceeds the threshold for an incident and declaring it. Correct answer.
  3. Conducting a post-incident review to update procedures.
  4. Restoring data from backups after an incident.

Explanation

Identification involves validating that an event is a true incident and formally declaring it, which triggers the response process. Patching, restoring data, and post-incident reviews belong to containment, recovery, and lessons learned, respectively.

Question 37Security Operations Fundamentals

An analyst receives an alert for a large outbound transfer to an unfamiliar cloud storage provider. Which additional evidence is most important to determine whether this is malicious exfiltration?

  1. The reputation score of the cloud provider's domain.
  2. The number of files stored on the user's workstation.
  3. The user identity and normal data transfer baselines for that account. Correct answer.
  4. The geolocation of the cloud provider's data center.

Explanation

To distinguish exfiltration from legitimate cloud use, analysts need to know who initiated the transfer and whether the volume and destination align with that user's normal behavior. Domain reputation, data center location, and local file count provide context but are less decisive.

Question 38Security Operations Fundamentals

A SOC is designing a detection for attackers who use only built-in administrative tools such as PowerShell and WMI. Which approach is most likely to be effective?

  1. Disabling WMI service on all endpoints.
  2. Blocking all PowerShell execution across the enterprise.
  3. Monitoring command-line arguments and script block logging for suspicious patterns. Correct answer.
  4. Relying solely on antivirus signatures for known malware.

Explanation

Living-off-the-land attacks evade signature-based detection, so monitoring command-line arguments and enabling script block logging can reveal malicious use of legitimate tools. Blocking all PowerShell or WMI is disruptive and often impractical, and antivirus signatures miss fileless techniques.

Question 39Security Operations Fundamentals

Which statement best describes how threat intelligence should be integrated into SOC operations?

  1. It should replace internal log analysis to reduce tooling costs.
  2. It should be automatically ingested as indicators into detection tools, with context and confidence scoring. Correct answer.
  3. It should be limited to open-source feeds to avoid vendor lock-in.
  4. It should be used only for post-incident reports, not for active detection.

Explanation

Threat intelligence adds value when indicators are operationalized in detection tools with context such as confidence and relevance, enabling prioritized alerting. It complements rather than replaces internal telemetry, and restricting to open source or post-incident use limits its benefit.

Question 40Security Operations Fundamentals

A SOC wants to measure its detection coverage against the MITRE ATT&CK framework. Which approach provides the most meaningful assessment?

  1. Mapping each detection rule to specific ATT&CK techniques and identifying gaps. Correct answer.
  2. Measuring the average time analysts spend per alert.
  3. Tracking the number of threat intelligence feeds subscribed to.
  4. Counting the total number of detection rules deployed.

Explanation

Mapping rules to ATT&CK techniques shows which adversary behaviors are covered and where gaps remain, enabling targeted improvements. Rule count, analyst time, and feed subscriptions do not reveal coverage of specific techniques.

Question 41Threat Analysis and Detection

In Cisco's threat detection architecture, which component is primarily responsible for correlating events from multiple detection sources and generating a single alert for a multi-stage intrusion?

  1. The intrusion prevention sensor's signature engine
  2. The endpoint protection agent's local quarantine module
  3. The managed detection and response analyst console
  4. The Security Intelligence (SI) eventing and correlation layer Correct answer.

Explanation

Security Intelligence (formerly Firepower Management Center intelligence and the Cisco SecureX/Secure Analytics layer) aggregates and correlates events from firewalls, IPS, endpoints, and identity sources so a chain of low-level events becomes a single high-fidelity alert. Signature engines and endpoint agents produce raw detections but do not perform cross-source correlation.

Question 42Threat Analysis and Detection

A security analyst sees a Snort-style rule with the header `alert tcp $HOME_NET any -> $EXTERNAL_NET 443`. What does this rule header specify?

  1. It inspects TCP traffic from the protected network to any external host on port 443 Correct answer.
  2. It blocks TCP traffic from external hosts to the protected network on port 443
  3. It inspects UDP traffic from the protected network to external hosts on port 53
  4. It logs all TCP traffic regardless of direction or port

Explanation

In Snort/Suricata syntax the action comes first, followed by protocol, source address and port, direction operator, and destination address and port. Here the action is alert, the protocol is TCP, the source is $HOME_NET on any port, and the destination is $EXTERNAL_NET on port 443.

Question 43Threat Analysis and Detection

During triage, an analyst observes repeated failed logons followed by a successful logon from the same source within two minutes, all against a single service account. Which detection concept best describes this pattern?

  1. DNS tunneling exfiltration
  2. Lateral movement via pass-the-hash
  3. Brute-force authentication success Correct answer.
  4. Living-off-the-land binary abuse

Explanation

A burst of failed authentications immediately followed by a success from the same source is the classic signature of a brute-force or password-spraying attempt that eventually guessed the credential. Pass-the-hash reuses a hash without repeated failures, DNS tunneling is a covert channel, and LOLBin abuse concerns legitimate binaries, none of which match the failed-then-success pattern.

Question 44Threat Analysis and Detection

Which indicator is most characteristic of a phishing email attempting to bypass link scanners by using a legitimate cloud file-sharing domain?

  1. A link to a well-known file-sharing service with a unique token that redirects to a credential-harvesting page Correct answer.
  2. A link whose visible text matches its href and points to the sender's corporate domain
  3. An email sent during business hours from a domain with a valid SPF record
  4. An email with a DKIM signature that validates against the sender's own domain

Explanation

Attackers abuse trusted file-sharing domains because reputation-based scanners often allow them; the unique token then redirects to a phishing page. Valid DKIM, SPF, and matching visible links are signs of legitimacy, not of scanner evasion.

Question 45Threat Analysis and Detection

An endpoint detection tool reports a process whose parent is `winword.exe` and whose command line includes `powershell -enc <base64>`. Which detection hypothesis does this most directly support?

  1. A scheduled backup task running under a service account
  2. A user manually opening PowerShell from the Start menu
  3. A legitimate Office update applying a patch
  4. A malicious macro spawning an encoded PowerShell payload Correct answer.

Explanation

Office applications spawning PowerShell with an encoded command is a well-known macro-based execution pattern used to hide the payload. Manual PowerShell use would have explorer.exe as the parent, and update or backup processes would not involve winword.exe as a parent.

Question 46Threat Analysis and Detection

Which data source is the best primary evidence for detecting credential dumping from LSASS memory on a Windows host?

  1. Proxy logs showing HTTPS CONNECT requests
  2. DHCP lease logs from the domain controller
  3. NetFlow records exported from the core switch
  4. Sysmon event ID 10 process access events with granted access to lsass.exe Correct answer.

Explanation

Sysmon Event ID 10 records process-access attempts and captures the target process and granted access rights, which reveals tools opening lsass.exe with memory-read permissions. Network flow, DHCP, and proxy logs lack the host-level process detail required to see memory access.

Question 47Threat Analysis and Detection

A threat intelligence feed provides a list of IPv4 addresses associated with command-and-control infrastructure. What is the most significant limitation of relying solely on this indicator type for detection?

  1. IPv4 addresses are encrypted in transit
  2. IP addresses cannot be logged by firewalls
  3. Infrastructure IPs rotate quickly, so static blocklists age out fast Correct answer.
  4. Firewalls cannot match on destination addresses

Explanation

Attackers frequently change C2 IP addresses, so IP-based blocklists have a short useful life and produce misses once infrastructure rotates. Firewalls can and do log and match destination addresses, and IP headers are not encrypted, so those claims are false.

Question 48Threat Analysis and Detection

Which technique best describes an adversary using `certutil.exe` to download a file from a remote server?

  1. ARP spoofing
  2. Living-off-the-land binary abuse Correct answer.
  3. Kerberoasting
  4. Registry persistence

Explanation

certutil.exe is a legitimate Windows utility whose download capability can be repurposed by attackers, which is the definition of living-off-the-land binary abuse. Registry persistence, Kerberoasting, and ARP spoofing describe unrelated mechanisms.

Question 49Threat Analysis and Detection

An analyst needs to detect DNS queries where the subdomain label is unusually long and high-entropy, repeating to the same parent domain. Which detection approach is most appropriate?

  1. Alert on any DNS query to a domain not seen in the last 24 hours
  2. Alert on every NXDOMAIN response
  3. Compute entropy and label length per query and baseline against normal DNS behavior Correct answer.
  4. Block all DNS traffic to external resolvers

Explanation

DNS tunneling and DNS-based exfiltration produce long, random-looking subdomain labels, so measuring label length and entropy against a learned baseline is the targeted detection. New-domain and NXDOMAIN alerts are noisy, and blocking all external resolvers is disruptive and not a detection method.

Question 50Threat Analysis and Detection

A detection rule fires when a single user account authenticates to more than 20 distinct internal hosts within 10 minutes. Which attack behavior is this rule most likely designed to catch?

  1. Data exfiltration over HTTPS
  2. Lateral movement using compromised credentials Correct answer.
  3. Password spraying against the domain controller
  4. Ransomware encryption of a file share

Explanation

One account authenticating to many internal hosts in a short window indicates an attacker moving across the network with stolen credentials. Password spraying targets many accounts from few sources, while exfiltration and encryption do not inherently require broad host-to-host authentication.