I85PREP
⌘ K
HTB CDSA study materials
HTB CDSA study resources

HTB CDSA practice questions

One question at a time. Build your HTB CDSA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Incident Response and Threat Hunting

During live incident response on a Windows host, you need to capture the current network connections and the process ID that owns each socket before containment. Which built-in command shows the owning PID alongside each connection?

  1. netstat -r
  2. ipconfig /displaydns
  3. route print
  4. netstat -ano Correct answer.

Explanation

The -a flag lists all connections and listening ports, -n keeps addresses numeric to avoid slow reverse lookups, and -o adds the owning process ID. That PID can then be correlated with tasklist or Get-Process to identify the responsible binary.

Question 2Incident Response and Threat Hunting

An analyst needs to preserve volatile memory from a running Linux server for malware analysis. Which approach best captures physical memory while minimizing changes to the running system?

  1. Use a kernel module such as LiME to dump memory to a file over the network or disk Correct answer.
  2. Export the output of free -m and vmstat to a text file
  3. Run gcore against PID 1 and analyze the resulting core
  4. Copy /proc/kcore with cp to an external drive

Explanation

LiME is a loadable kernel module purpose-built to acquire physical memory on Linux with minimal footprint, writing to disk or across the network. Copying /proc/kcore is unreliable and not a faithful physical-memory image, and per-process core dumps capture only one address space.

Question 3Incident Response and Threat Hunting

Which Windows artifact most directly records program execution by storing metadata for executables launched on the system, including a SHA-1 value in many versions?

  1. Prefetch files
  2. Amcache.hve Correct answer.
  3. NTUSER.DAT
  4. Setupapi.dev.log

Explanation

Amcache.hve stores metadata about executed or installed binaries, including file paths and, on many Windows versions, a SHA-1 hash of the executable. That makes it valuable for identifying malware that has since been deleted from disk.

Question 4Incident Response and Threat Hunting

You are triaging an alert and want to quickly determine whether a suspicious process has established outbound connections to an external IP. Which combination of Sysmon event IDs is most relevant?

  1. Event ID 1 and Event ID 3 Correct answer.
  2. Event ID 22 and Event ID 23
  3. Event ID 11 and Event ID 12
  4. Event ID 7 and Event ID 10

Explanation

Sysmon Event ID 1 records process creation and Event ID 3 records network connections, so pairing them lets you spot a process and its outbound sockets. Correlating the ProcessGuid across those events ties the connection to the originating binary.

Question 5Incident Response and Threat Hunting

In the MITRE ATT&CK framework, which tactic describes an adversary attempting to move laterally to other systems after initial access?

  1. Collection
  2. Execution
  3. Lateral Movement Correct answer.
  4. Exfiltration

Explanation

Lateral Movement is the tactic covering techniques an adversary uses to enter and control remote systems on a network. Execution covers running code, Collection covers gathering data, and Exfiltration covers stealing it out of the environment.

Question 6Incident Response and Threat Hunting

A threat hunter wants to find beaconing behavior in proxy logs. Which pattern most strongly suggests command-and-control beaconing rather than normal user browsing?

  1. Bursts of requests to many unrelated domains within a minute
  2. High-volume downloads during business hours from popular sites
  3. Regular connections at near-constant intervals to the same rare domain with small, uniform payloads Correct answer.
  4. Large one-off uploads to a CDN at random times

Explanation

Beaconing is characterized by periodic, low-jitter connections to a consistent endpoint with small, similar request sizes. The regularity, rarity of the destination, and uniformity distinguish it from human browsing, which is bursty and varied.

Question 7Incident Response and Threat Hunting

When collecting evidence from a live system, which action best preserves evidentiary integrity for later legal or forensic use?

  1. Editing log files to remove noise before archiving
  2. Copying files with a tool that updates last-access timestamps
  3. Compressing evidence into a password-protected archive without recording the password
  4. Documenting the collection, computing hashes of acquired images, and maintaining a chain of custody Correct answer.

Explanation

Integrity depends on documented collection, cryptographic hashes proving the image is unchanged, and an unbroken chain of custody. These steps let another party verify that the evidence was not altered after acquisition.

Question 8Incident Response and Threat Hunting

Which Linux log source is most useful for identifying failed SSH authentication attempts during an intrusion investigation?

  1. /etc/passwd
  2. /var/log/auth.log on Debian-based systems Correct answer.
  3. /var/log/dpkg.log
  4. /var/log/boot.log

Explanation

On Debian-based systems, sshd writes authentication successes and failures to /var/log/auth.log, making it the primary source for brute-force or credential-stuffing evidence. On RHEL-based systems the equivalent records appear in /var/log/secure.

Question 9Incident Response and Threat Hunting

During analysis of a suspicious Windows binary, you observe it calls VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread against another process. Which behavior does this sequence most likely indicate?

  1. Credential dumping from LSASS
  2. Fileless execution through WMI
  3. Registry persistence via Run key
  4. Process injection into a remote process Correct answer.

Explanation

Allocating memory in another process, writing a payload there, and creating a remote thread is the classic sequence for remote process injection. This lets an adversary execute code inside a trusted process to evade detection.

Question 10Incident Response and Threat Hunting

A hunter wants to detect Kerberoasting attempts against a domain. Which event pattern is most indicative of this attack?

  1. Many TGS requests with RC4 encryption (0x17) for service accounts with SPNs from one account in a short window Correct answer.
  2. A single user requesting a TGS for one service account during logon
  3. A burst of LDAP queries from a domain controller
  4. Repeated failed NTLM authentications from one workstation

Explanation

Kerberoasting requests service tickets for accounts with SPNs and often forces weaker RC4 encryption so the ticket can be cracked offline. A spike of such TGS requests for multiple SPNs from a single principal is a strong indicator.

Question 11Incident Response and Threat Hunting

You suspect a compromised host is using DNS tunneling for exfiltration. Which log field combination best supports this hypothesis?

  1. Frequent PTR lookups for internal RFC1918 addresses
  2. Repeated A record lookups for a popular search engine
  3. High volume of queries with long, high-entropy subdomains to one parent domain Correct answer.
  4. Periodic queries to the domain controller for SRV records

Explanation

DNS tunneling encodes data in subdomain labels, producing long, random-looking names under a single attacker-controlled domain at high volume. Normal traffic queries short, recognizable names across many domains.

Question 12Incident Response and Threat Hunting

When performing memory analysis with Volatility 3, which plugin would you use to list processes that were active when the image was captured?

  1. windows.cmdline
  2. windows.pslist Correct answer.
  3. windows.malfind
  4. windows.netscan

Explanation

windows.pslist walks the active process list in the memory image and reports running processes. It is the standard starting point before comparing against other views such as psscan or analyzing injected memory with malfind.

Question 13Incident Response and Threat Hunting

An analyst sees a Windows service binary path in the registry that points to an unquoted path containing spaces, such as C:\Program Files\Acme App\svc.exe. What risk does this represent?

  1. Golden ticket forgery
  2. Unquoted service path privilege escalation Correct answer.
  3. DLL search order hijacking
  4. Pass-the-hash authentication

Explanation

When a service path with spaces is unquoted, Windows tries candidate executables in order, so a writable directory earlier in the path can let a low-privileged user plant a binary that runs as the service account. Quoting the path removes the ambiguity.

Question 14Incident Response and Threat Hunting

Which Splunk SPL search best identifies a process creation event where PowerShell was launched with an encoded command?

  1. index=win EventCode=5156
  2. index=win EventCode=4624 LogonType=3
  3. index=win EventCode=4688 CommandLine="*-enc*" OR CommandLine="*-EncodedCommand*" Correct answer.
  4. index=win EventCode=1102

Explanation

Event ID 4688 with process command-line auditing enabled captures the command line, so filtering for the -enc or -EncodedCommand switches surfaces encoded PowerShell. Encoded commands are commonly used to obfuscate malicious scripts.

Question 15Incident Response and Threat Hunting

A responder wants to contain a compromised endpoint while preserving volatile evidence. Which sequence is most appropriate?

  1. Delete suspicious files, then reboot to see if the issue recurs
  2. Immediately power off the host, then image the disk
  3. Capture memory and relevant volatile data, then isolate the host from the network Correct answer.
  4. Reimage the host first, then collect logs from backups

Explanation

Order of volatility dictates capturing memory and volatile state before anything that could destroy it, then isolating the host to stop spread. Powering off or reimaging first destroys memory-resident evidence.

Question 16Incident Response and Threat Hunting

Which artifact would best help you determine what USB mass-storage devices were connected to a Windows system and when?

  1. SRUM database only
  2. SYSTEM registry hive USBSTOR keys combined with setupapi.dev.log Correct answer.
  3. SAM registry hive
  4. Windows Defender operational log

Explanation

USBSTOR keys under the SYSTEM hive record connected storage devices and their serial numbers, while setupapi.dev.log provides timestamps of device installation. Together they establish device presence and timing.

Question 17Incident Response and Threat Hunting

An analyst observes a scheduled task created to run a script from a user-writable directory every five minutes. Which ATT&CK technique does this most directly represent?

  1. Account Discovery
  2. Network Service Scanning
  3. Scheduled Task/Job Correct answer.
  4. Indicator Removal

Explanation

Creating a scheduled task to repeatedly execute a payload is the Scheduled Task/Job technique used for persistence. The recurring execution maintains access across reboots and logons.

Question 18Incident Response and Threat Hunting

You are reviewing a packet capture and need to extract files transferred over HTTP. Which Wireshark feature is designed for this task?

  1. Statistics > Protocol Hierarchy
  2. Follow TCP Stream and export the stream contents Correct answer.
  3. Capture filters using host and port
  4. The coloring rules dialog

Explanation

Following the TCP stream reassembles the conversation so an analyst can view and export the transferred object. For HTTP, File > Export Objects > HTTP provides an even more direct extraction path.

Question 19Incident Response and Threat Hunting

During log review you find Event ID 4625 with Logon Type 3 occurring hundreds of times per minute against many accounts from one source. What activity does this most likely represent?

  1. A successful privilege escalation
  2. A password spray or brute-force attempt against network logons Correct answer.
  3. Normal Kerberos ticket renewal
  4. Routine Group Policy refresh

Explanation

Event ID 4625 records failed logons, and Logon Type 3 indicates network authentication. A high rate of failures across many accounts from a single source is characteristic of password spraying or brute force.

Question 20Incident Response and Threat Hunting

A hunter wants to identify potential data staging before exfiltration on a Windows host. Which behavior is most consistent with staging?

  1. Editing a single document in place
  2. Compressing many documents into a single archive in a temporary directory Correct answer.
  3. Running a routine antivirus scan
  4. Browsing a shared drive read-only

Explanation

Staging often involves collecting and compressing files into an archive in a staging location before transfer. A sudden archive creation aggregating many files in a temp directory is a common precursor to exfiltration.

Question 21Incident Response and Threat Hunting

An analyst needs to determine whether a Linux binary was recently replaced by an attacker. Which command best verifies package-managed files against known-good hashes?

  1. ps aux
  2. ls -la /usr/bin
  3. rpm -Va or debsums Correct answer.
  4. netstat -tulpn

Explanation

rpm -Va on RPM systems and debsums on Debian systems compare installed file hashes against package metadata, flagging modified binaries. This detects tampering with files that should match their packaged versions.

Question 22Incident Response and Threat Hunting

A compromised host shows a new local administrator account with a suspicious name and no corresponding helpdesk ticket. Which ATT&CK technique and defensive check best match this finding?

  1. Drive-by Compromise; review browser history
  2. Exploitation for Client Execution; review patch levels
  3. Phishing; review mail gateway logs
  4. Create Account; review Security log Event IDs 4720 and 4732 Correct answer.

Explanation

Creating a local account maps to the Create Account technique, and adding it to Administrators maps to account manipulation. Event ID 4720 records account creation and 4732 records addition to a security-enabled local group.

Question 23Incident Response and Threat Hunting

During memory forensics, you find a process visible in psscan but absent from pslist. What is the most likely explanation?

  1. The process is a legitimate system idle process
  2. The process was terminated or hidden and its pool structures remain in memory Correct answer.
  3. psscan only lists kernel threads
  4. The memory image was captured incorrectly and should be discarded

Explanation

psscan carves process objects from pool memory, so it can reveal processes that were unlinked from the active list or already terminated. A discrepancy between pslist and psscan often indicates process hiding or a recently exited process.

Question 24Incident Response and Threat Hunting

An adversary uses a signed, legitimate binary such as certutil to download a payload. Which detection strategy is most robust against this living-off-the-land technique?

  1. Blocking all execution of certutil across the enterprise
  2. Alerting on process command lines that combine certutil with URL or decode arguments Correct answer.
  3. Relying solely on file hash blocklists
  4. Alerting only on unsigned binaries in temp directories

Explanation

LOLBins are legitimate signed tools, so detection must focus on anomalous command-line arguments and parent-child relationships rather than the binary itself. Flagging certutil invoked with URL or decode flags catches abuse while permitting legitimate administrative use.

Question 25Incident Response and Threat Hunting

You are correlating an intrusion and find that a service account authenticated to twelve workstations within two minutes using NTLM, followed by service creation on each. Which conclusion is best supported?

  1. Lateral movement using stolen service account credentials and remote service creation Correct answer.
  2. A Kerberos golden ticket attack
  3. A benign software deployment pushed by the service account
  4. A DNS tunneling exfiltration campaign

Explanation

Rapid NTLM authentications from one service account across many hosts, immediately followed by service creation, matches credential reuse for lateral movement. Service creation is a common remote execution method once credentials are validated.

Question 26Incident Response and Threat Hunting

A hunter is building a hypothesis around a suspected intrusion and wants to apply the threat-hunting loop. Which activity best represents the 'hypothesis' stage rather than the data-collection stage?

  1. Stating that an adversary using a commodity loader will likely create a scheduled task within ten minutes of initial execution Correct answer.
  2. Reviewing the retention policy for endpoint telemetry
  3. Exporting Sysmon Event ID 1 records for the past 30 days into a search index
  4. Configuring a Splunk forwarder on newly built servers

Explanation

A hypothesis is a falsifiable statement about attacker behavior that predicts observable evidence, which is then tested against telemetry. Collecting, forwarding, and retaining data are enabling logistics, not the hypothesis itself. The hypothesis must be specific enough that its presence or absence in the data can confirm or refute it.

Question 27Incident Response and Threat Hunting

During an incident, a responder must decide whether to isolate a host immediately or continue monitoring. Which factor most directly justifies continued monitoring before containment?

  1. The host has a full disk image already captured from last quarter
  2. The intrusion is still unfolding and containment would tip off the adversary before additional victims and infrastructure are identified Correct answer.
  3. The user has a deadline and asked to keep working
  4. The endpoint agent is reporting a healthy heartbeat

Explanation

Delaying containment is a deliberate trade-off used when visibility into the adversary's scope and infrastructure is worth more than stopping the activity. The decision hinges on whether continued observation will reveal additional compromised hosts, accounts, or C2 channels. Business convenience and prior backups do not justify leaving an active intrusion running.

Question 28Incident Response and Threat Hunting

A hunter is reviewing Windows Security logs and wants to detect a pass-the-hash style lateral movement using NTLM. Which event combination is most indicative?

  1. Event ID 4624 with Logon Type 3 and Authentication Package NTLM from a workstation to a server, followed by Event ID 4672 for the same account Correct answer.
  2. Event ID 4634 logoff events occurring at end of business hours
  3. Event ID 4768 TGT requests from a single workstation
  4. Event ID 4776 credential validation failures from a domain controller

Explanation

Pass-the-hash produces network logons (Type 3) authenticated with NTLM rather than Kerberos, often from an unusual source workstation. When the reused hash belongs to a privileged account, the session is frequently followed by special-privilege assignment (4672). Kerberos TGT requests and routine logoffs do not match this pattern.

Question 29Incident Response and Threat Hunting

Which Windows event log channel should an analyst query first to review PowerShell script block content that was executed on a host?

  1. Security
  2. Microsoft-Windows-PowerShell/Operational Correct answer.
  3. System
  4. Application

Explanation

Script block logging writes Event ID 4104 to the Microsoft-Windows-PowerShell/Operational channel with the deobfuscated script text. The Security channel holds authentication and object-access auditing, while System and Application hold OS and application events. Reviewing the wrong channel will miss the actual code that ran.

Question 30Incident Response and Threat Hunting

A hunter wants to identify possible data exfiltration over HTTPS without full TLS inspection. Which log-derived metric is most useful as a starting signal?

  1. The number of distinct destination IP addresses contacted per host per day
  2. The ratio of bytes sent to bytes received for a host's connections to a single external destination over time Correct answer.
  3. The average TTL value observed on inbound packets
  4. The count of DNS A records resolved by the host

Explanation

Exfiltration over encrypted channels typically shows an asymmetric byte ratio where outbound volume greatly exceeds inbound for a sustained period to one destination. That ratio is observable in proxy or firewall flow logs without decrypting content. Destination counts, DNS lookups, and TTL values describe other behaviors and are far weaker signals for volume-based exfiltration.

Question 31Incident Response and Threat Hunting

An analyst is triaging a suspected compromised Linux server and wants to identify a process that is listening on a port but whose binary has been deleted from disk. Which command output is most directly useful?

  1. ss -lntp, checking whether the process name is shown for each listener Correct answer.
  2. df -h, checking filesystem utilization
  3. last -a, reviewing recent login history
  4. journalctl -k, reviewing kernel boot messages

Explanation

Listing listening sockets with their owning process lets the analyst map a port to a PID and then inspect that process's executable path, where a deleted binary is often revealed. Login history, disk usage, and kernel messages do not associate listening ports with processes. The socket-to-process mapping is the necessary first step before examining the executable.

Question 32Incident Response and Threat Hunting

A hunter observes a workstation resolving many unique, high-entropy subdomains under a single parent domain, each returning a short TTL and an A record pointing to the same external IP. Which conclusion is best supported?

  1. The parent domain is a parked domain with no active records
  2. The host is performing normal content delivery network lookups
  3. The workstation is likely participating in DNS-based command-and-control or exfiltration Correct answer.
  4. The resolver cache is corrupted and should be flushed

Explanation

High-entropy labels under one parent, short TTLs, and a consistent destination are characteristic of encoding data or commands in DNS queries. CDN lookups usually use recognizable hostnames and varied infrastructure, and a parked domain would not return consistent A records. This pattern warrants follow-up on query volume and label structure.

Question 33Incident Response and Threat Hunting

Which artifact most reliably shows the command line used when a Windows process started, assuming the appropriate audit policy is enabled?

  1. Security Event ID 4688 with command line auditing enabled Correct answer.
  2. Amcache.hve entry for the binary
  3. UserAssist registry key under the user's hive
  4. Prefetch file for the executable

Explanation

Event ID 4688 records process creation and, when command line auditing is turned on, includes the full command line in the event. Prefetch and Amcache show that a binary executed but not its arguments, and UserAssist tracks GUI program launches. Only 4688 with the audit setting captures the invocation details.

Question 34Incident Response and Threat Hunting

A responder is preparing to acquire volatile data from a running Windows host. Which ordering principle should guide collection?

  1. Collect the most volatile data first, then progressively less volatile sources Correct answer.
  2. Collect only artifacts named in the incident ticket
  3. Collect data in alphabetical order of artifact name
  4. Collect the hard drive image first, then memory

Explanation

The order of volatility dictates capturing the fastest-changing data, such as memory and network connections, before it is lost, then moving to more persistent storage. Imaging the disk first risks losing volatile state that cannot be recovered later. Alphabetical or ticket-limited collection ignores decay rates and can destroy evidence.

Question 35Incident Response and Threat Hunting

A hunter wants to detect adversary use of Windows Management Instrumentation for remote process execution. Which telemetry combination is most specific?

  1. Event ID 4688 showing wmic.exe with a process call node and a remote target, correlated with a Type 3 logon from the same source Correct answer.
  2. Event ID 5156 firewall allow events on the target
  3. Event ID 4624 Type 2 interactive logons on the target
  4. Event ID 7045 service installation on the target

Explanation

Remote WMI execution typically appears as wmic.exe invoking a process call against a node, paired with a network logon from the originating host. Correlating the process creation with the Type 3 logon ties the command to its source. Interactive logons, service installs, and firewall allows describe different techniques or lack the execution detail.

Question 36Incident Response and Threat Hunting

During memory analysis, an analyst wants to enumerate network connections that existed at capture time along with the owning process. Which approach is appropriate with Volatility 3?

  1. Run the windows.malfind plugin and review injected regions
  2. Run the windows.hashdump plugin and review credential hashes
  3. Run the windows.netscan plugin and review the owning PID column Correct answer.
  4. Run the windows.svcscan plugin and review service entries

Explanation

The netscan plugin parses network structures from the memory image and reports local and remote endpoints with the owning process ID. Malfind looks for injected code, hashdump extracts credential material, and svcscan enumerates services. Only netscan answers the question about connections and their processes.

Question 37Incident Response and Threat Hunting

A hunter is writing a Sigma rule to detect suspicious archive creation prior to exfiltration. Which field selection makes the rule most portable across SIEM backends?

  1. Embedding a Splunk-specific eval function inside the detection logic
  2. Hard-coding a single vendor's field name for the process image path
  3. Using generic logsource categories and standard field names that Sigma converts per backend Correct answer.
  4. Relying on a regex that matches the entire raw event string

Explanation

Sigma is designed to be backend-agnostic; rules use generic logsource categories and field names that conversion tools map to each SIEM's schema. Vendor-specific field names or inline query functions break portability. Matching the whole raw event is brittle and produces high false-positive rates.

Question 38Incident Response and Threat Hunting

An analyst reviewing a packet capture sees a client complete a TCP handshake, send an HTTP request, and then receive a response whose Content-Length header does not match the observed body length. Which interpretation is most reasonable?

  1. The connection is using UDP rather than TCP
  2. The client is performing a SYN flood
  3. The server is using chunked transfer encoding, which omits Content-Length in favor of chunk sizes Correct answer.
  4. The capture is definitely corrupted and should be discarded

Explanation

When a response uses chunked transfer encoding, the body is framed by chunk sizes rather than a Content-Length value, so a mismatch with any stated length is expected. A completed handshake and HTTP exchange rule out a SYN flood, and UDP cannot carry a TCP handshake. Discarding the capture would lose valid evidence.

Question 39Incident Response and Threat Hunting

A hunter wants to baseline normal parent-child process relationships on Windows endpoints to spot anomalous spawning. Which data source is most appropriate for building that baseline?

  1. Windows Update history in the SoftwareDistribution log
  2. Sysmon Event ID 1 process creation records including ParentImage and Image fields Correct answer.
  3. Group Policy Results reports for the domain
  4. DNS client cache entries captured at boot

Explanation

Sysmon Event ID 1 records process creation with both the parent image and the child image, which is exactly the relationship needed for baselining. Update history, DNS cache, and Group Policy reports describe patching, name resolution, and configuration. None of those capture process lineage.

Question 40Incident Response and Threat Hunting

A hunter is comparing two hypotheses: one about commodity ransomware and one about a targeted intrusion. Which characteristic most distinguishes targeted intrusion activity in telemetry?

  1. Immediate encryption of files across the estate
  2. Frequent execution of known commodity packers on many endpoints
  3. Higher overall volume of blocked malware alerts
  4. Use of living-off-the-land binaries and low-noise credential access aligned to specific hosts and accounts Correct answer.

Explanation

Targeted intrusions favor native tools, minimal noise, and actions scoped to high-value hosts and accounts to avoid detection. Commodity campaigns tend to produce broad, noisy signals such as mass blocked alerts, widespread packer execution, and rapid encryption. The distinguishing feature is selectivity and stealth rather than volume.

Question 41Security Information and Event Management (SIEM) and Log Analysis

In a SIEM, which component is responsible for normalizing raw events from different sources into a common schema before correlation rules run?

  1. The retention and archiving tier
  2. The log parser and field extraction pipeline Correct answer.
  3. The alert notification channel
  4. The dashboard visualization layer

Explanation

Normalization and field extraction happen in the ingestion/parsing pipeline, which maps vendor-specific formats into a common taxonomy so correlation rules can reference consistent field names. Dashboards, notifications, and retention tiers consume already-processed data and do not reshape raw events.

Question 42Security Information and Event Management (SIEM) and Log Analysis

An analyst wants to detect a brute-force attempt against SSH on a Linux host. Which log source and field combination is the most direct evidence?

  1. syslog entries showing cron job scheduling messages every minute
  2. auth.log entries showing repeated 'Failed password' lines for the same user from one source IP within a short window Correct answer.
  3. kern.log entries showing USB device attach events
  4. dpkg.log entries showing package installation activity

Explanation

SSH authentication failures are recorded by the PAM/sshd stack into auth.log (or /var/log/secure on RHEL-family systems), including the username and source address. Counting repeated 'Failed password' events per user and source IP over a short interval is the canonical brute-force signal.

Question 43Security Information and Event Management (SIEM) and Log Analysis

Which Windows event ID records a successful logon and includes the Logon Type field used to distinguish interactive, network, and service logons?

  1. 4688
  2. 4624 Correct answer.
  3. 4625
  4. 4672

Explanation

Event ID 4624 is logged on successful account logon and carries the Logon Type value (for example 2 for interactive, 3 for network, 5 for service). Analysts use it to baseline normal logon behavior and spot anomalous logon types.

Question 44Security Information and Event Management (SIEM) and Log Analysis

A SIEM correlation rule uses a threshold of five failed logons from the same account within 60 seconds. What is the primary purpose of the time window in this rule?

  1. To control how often the SIEM synchronizes its clock with NTP
  2. To group related events so that scattered failures are evaluated as a single behavioral pattern Correct answer.
  3. To limit how long alerts remain visible on the analyst dashboard
  4. To define how long raw logs are retained before deletion

Explanation

A time window bounds the set of events considered together, allowing the rule to detect a burst of related activity rather than isolated events. It is a correlation parameter, distinct from retention, alert display, or time synchronization settings.

Question 45Security Information and Event Management (SIEM) and Log Analysis

Which field in a proxy or web server log is most useful for identifying the client that made a request when investigating a suspected web shell interaction?

  1. The server's local timezone offset
  2. The HTTP response Content-Length header
  3. The source IP address and User-Agent string recorded with the request Correct answer.
  4. The server's TLS certificate serial number

Explanation

Source IP and User-Agent identify the requesting client and its tooling, which helps distinguish a legitimate browser from an automated client such as curl or a known attack tool. Response size, certificate serials, and timezone offsets do not attribute the request to a client.

Question 46Security Information and Event Management (SIEM) and Log Analysis

What does a SIEM typically use to correlate events across sources that record time in different formats and zones?

  1. Discarding timestamps and relying only on ingestion order
  2. Converting all timestamps to the analyst's browser locale at query time
  3. Normalizing all timestamps to a single reference timezone such as UTC during ingestion Correct answer.
  4. Storing each source's local time unchanged and comparing strings lexically

Explanation

Consistent time normalization, usually to UTC, is required so events from hosts in different zones can be ordered and joined correctly. Lexical comparison of mixed local times or reliance on ingestion order produces incorrect sequences.

Question 47Security Information and Event Management (SIEM) and Log Analysis

Which Sysmon event ID captures process creation with command line, parent process, and hash information?

  1. Event ID 11
  2. Event ID 3
  3. Event ID 22
  4. Event ID 1 Correct answer.

Explanation

Sysmon Event ID 1 is Process Create and includes Image, CommandLine, ParentImage, and hash fields, making it a primary telemetry source for endpoint detection. Other Sysmon IDs cover network connections, file creation, and DNS queries respectively.

Question 48Security Information and Event Management (SIEM) and Log Analysis

An analyst searches for events where a user account was added to a privileged group. On Windows domain controllers, which event ID should be queried?

  1. 4624
  2. 7045
  3. 5156
  4. 4728 Correct answer.

Explanation

Event ID 4728 records a member being added to a security-enabled global group, which includes privileged domain groups. It is a key signal for unauthorized privilege escalation via group membership changes.

Question 49Security Information and Event Management (SIEM) and Log Analysis

A SIEM rule fires on 'multiple 4625 events followed by a 4624 for the same account'. What activity does this sequence most likely represent?

  1. A user changing their password through the standard reset flow
  2. A successful password-guessing or credential-stuffing attempt after repeated failures Correct answer.
  3. A domain controller replicating account data to a peer
  4. A routine scheduled service account logon

Explanation

Repeated failed logons immediately followed by a success for the same account indicate that a guessed or stuffed credential eventually worked. Service logons and password resets do not normally produce a burst of failures preceding the success.

Question 50Security Information and Event Management (SIEM) and Log Analysis

During triage, an analyst must decide whether an alert is a true positive. Which approach best supports that decision?

  1. Escalating every alert without review to avoid missing anything
  2. Disabling the rule so the queue stays manageable
  3. Pivoting from the alert to surrounding raw events to reconstruct the sequence of activity on the affected host Correct answer.
  4. Closing the alert because the rule has fired many times before

Explanation

Triage requires contextual validation: pulling the raw events around the alert to confirm whether the behavior is real and malicious. Closing on frequency, blind escalation, or rule suppression all discard the evidence needed for a defensible decision.