I85PREP
⌘ K
OSIR study materials
OSIR study resources

OSIR practice questions

One question at a time. Build your OSIR understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Operations and Incident Response Fundamentals

During incident response, which phase immediately follows detection and validation of a security event according to the standard incident response lifecycle?

  1. Recovery
  2. Containment Correct answer.
  3. Lessons learned
  4. Eradication

Explanation

After an event is detected and confirmed as an incident, the team moves to containment to limit spread and damage before removing the threat. Eradication and recovery come later, and lessons learned closes the process. Containment precedes all remediation activity.

Question 2Security Operations and Incident Response Fundamentals

A SOC analyst receives an alert at 03:00 and must decide whether it is a true incident. Which activity best describes this triage step?

  1. Notifying regulators of a confirmed data breach
  2. Rebuilding the affected system from a golden image
  3. Validating and scoping the alert to confirm whether it is a genuine incident Correct answer.
  4. Performing a full forensic disk image of the affected host

Explanation

Triage validates an alert, determines scope, and confirms whether it is a true positive before escalating. Imaging, notification, and rebuilds are later actions that depend on confirmation. Validation is the correct first decision point.

Question 3Security Operations and Incident Response Fundamentals

Which data source is most useful for establishing the timeline of user logon activity across a Windows enterprise?

  1. Network switch port configurations
  2. Antivirus scan schedules
  3. Security event logs collected via centralized log management Correct answer.
  4. Printer spooler logs

Explanation

Windows Security logs record authentication events such as logon success and failure, and centralizing them enables timeline reconstruction across hosts. The other sources do not record user authentication activity. Correlating these logs is fundamental to incident scoping.

Question 4Security Operations and Incident Response Fundamentals

An analyst wants to preserve volatile evidence on a running Linux server before shutting it down. Which action best follows evidence-handling principles?

  1. Immediately power off the host to stop attacker activity
  2. Delete suspicious files to prevent reinfection
  3. Reimage the server to restore service quickly
  4. Capture memory and running process state before powering off the host Correct answer.

Explanation

Volatile data such as memory and running processes is lost on shutdown, so it must be captured first. Powering off, deleting files, or reimaging destroys evidence and impedes investigation. Order of volatility guides preservation decisions.

Question 5Security Operations and Incident Response Fundamentals

What is the primary purpose of a chain-of-custody record for digital evidence?

  1. Automatically deleting evidence after a retention period
  2. Documenting who handled evidence, when, and how to prove integrity Correct answer.
  3. Encrypting evidence so attackers cannot read it
  4. Compressing evidence to save storage space

Explanation

Chain of custody documents every transfer and access of evidence so its integrity can be demonstrated in legal or disciplinary proceedings. It does not encrypt, compress, or delete data. A complete, unbroken record supports admissibility.

Question 6Security Operations and Incident Response Fundamentals

Which indicator most strongly suggests a phishing email attempting credential theft?

  1. A plain-text email without attachments
  2. A link whose visible text differs from the actual destination URL Correct answer.
  3. A message with a company logo in the signature
  4. An email sent during business hours

Explanation

Mismatched link text and destination is a classic phishing indicator used to redirect victims to attacker-controlled credential harvesting pages. Business-hour timing, logos, and plain text are common in legitimate mail. Verifying link destinations is a core analyst check.

Question 7Security Operations and Incident Response Fundamentals

In the context of security operations, what does the MITRE ATT&CK framework primarily provide?

  1. A catalog of hardware vulnerabilities with CVSS scores
  2. A knowledge base of adversary tactics and techniques observed in real intrusions Correct answer.
  3. A regulatory compliance checklist
  4. A list of approved firewall rule sets

Explanation

ATT&CK organizes observed adversary behavior into tactics and techniques, helping defenders map detections and prioritize coverage. It is not a firewall ruleset, compliance checklist, or hardware vulnerability catalog. Analysts use it to describe attacker behavior consistently.

Question 8Security Operations and Incident Response Fundamentals

A workstation begins contacting a known command-and-control domain every 60 seconds. Which containment action best limits further damage while preserving investigative options?

  1. Shut down the entire corporate network
  2. Format the hard drive immediately
  3. Isolate the host from the network while keeping it powered on for analysis Correct answer.
  4. Wait for the next scheduled antivirus scan

Explanation

Network isolation stops beaconing and lateral movement while preserving volatile state for investigation. Formatting or shutting down the whole network destroys evidence or causes unnecessary disruption. Waiting allows the adversary to continue operating.

Question 9Security Operations and Incident Response Fundamentals

An analyst observes repeated failed logons followed by a success from the same source IP across many accounts. Which attack pattern does this most likely indicate?

  1. A misconfigured DNS server
  2. Password spraying leading to a successful compromise Correct answer.
  3. A physical break-in
  4. A denial-of-service flood

Explanation

Many accounts failing then one succeeding from a single source is consistent with password spraying, where a few common passwords are tried across many accounts. DoS, physical intrusion, and DNS misconfiguration do not produce this pattern. The success warrants immediate investigation.

Question 10Security Operations and Incident Response Fundamentals

What is the main benefit of running a tabletop exercise for incident response?

  1. Replacing the need for a written incident response plan
  2. Satisfying all regulatory notification obligations
  3. Practicing roles and decision-making against a simulated scenario without production impact Correct answer.
  4. Testing production systems under real attack load

Explanation

Tabletop exercises let teams rehearse coordination, communication, and decisions in a safe simulated setting. They complement, not replace, the written plan, and they do not test production systems or fulfill notification duties. Regular exercises reveal gaps before a real incident.

Question 11Security Operations and Incident Response Fundamentals

Which metric best measures how quickly a SOC detects an incident after it actually begins?

  1. Mean time to detect Correct answer.
  2. Alert volume per day
  3. Number of analysts on shift
  4. Mean time to resolve

Explanation

Mean time to detect measures elapsed time from incident onset to detection, directly reflecting detection capability. Time to resolve measures remediation, while alert volume and staffing describe workload rather than detection speed. Reducing detection time limits attacker dwell time.

Question 12Security Operations and Incident Response Fundamentals

An analyst must decide whether to escalate a suspected ransomware infection on a file server. Which factor most strongly justifies immediate escalation?

  1. A single user reporting slow application performance
  2. Evidence of active file encryption and lateral spread to other hosts Correct answer.
  3. A scheduled backup completing successfully
  4. A patch released last week for an unrelated service

Explanation

Active encryption and spread indicate an ongoing high-impact incident requiring immediate escalation and containment. Slow performance alone is ambiguous, and backups or unrelated patches do not signal active compromise. Impact and spread drive escalation severity.

Question 13Security Operations and Incident Response Fundamentals

What does the principle of least privilege contribute to security operations?

  1. It removes the requirement for incident response plans
  2. It guarantees that no malware can execute on a host
  3. It reduces the blast radius if an account or process is compromised Correct answer.
  4. It eliminates the need for logging and monitoring

Explanation

Least privilege limits the permissions available to users and processes, shrinking the impact of compromise and lateral movement. It does not prevent all malware, replace logging, or obviate response planning. It is a foundational preventive control.

Question 14Security Operations and Incident Response Fundamentals

During an investigation, an analyst finds a scheduled task created at 02:14 that launches a PowerShell script from a temporary directory. Which conclusion is most defensible?

  1. The task is a persistence mechanism warranting further investigation Correct answer.
  2. The task indicates a hardware failure
  3. The task is benign because it runs a script
  4. The task proves data exfiltration already occurred

Explanation

A newly created scheduled task launching PowerShell from a temp directory is a common persistence technique and merits investigation. Script execution alone does not prove benign intent, and it does not by itself prove exfiltration or hardware failure. Analysts should correlate with other telemetry.

Question 15Security Operations and Incident Response Fundamentals

Which practice best supports effective log correlation during incident response?

  1. Retaining logs for a single day
  2. Storing logs only on the endpoint that generated them
  3. Disabling time synchronization to avoid drift
  4. Synchronizing clocks across systems and normalizing timestamps Correct answer.

Explanation

Accurate, synchronized timestamps and normalized formats allow events from different systems to be aligned into a coherent timeline. Local-only storage, disabled time sync, and short retention all undermine correlation. Consistent time is essential for reconstructing incidents.

Question 16Security Operations and Incident Response Fundamentals

A vulnerability scan reports a critical flaw on an internet-facing server. What is the most appropriate security operations response?

  1. Ignore it because scans produce false positives
  2. Publish the finding publicly before patching
  3. Disable all logging to reduce noise
  4. Assess exploitability and exposure, then prioritize remediation through change management Correct answer.

Explanation

Findings should be validated for exploitability and exposure, then remediated through controlled change management to avoid disruption. Ignoring findings, disabling logging, or public disclosure before remediation are unsafe. Prioritization balances risk and operational impact.

Question 17Security Operations and Incident Response Fundamentals

Which element is essential in an incident response plan to ensure timely communication with executives?

  1. A copy of the marketing style guide
  2. A list of every software license in use
  3. A schedule of office cleaning services
  4. A defined escalation and notification matrix with roles and contacts Correct answer.

Explanation

An escalation and notification matrix defines who is informed, when, and by whom, enabling timely executive communication. License inventories, style guides, and cleaning schedules do not support incident communication. Clear roles prevent delays during high-pressure events.

Question 18Security Operations and Incident Response Fundamentals

An analyst needs to determine whether a suspicious binary is malicious without executing it. Which approach is most appropriate?

  1. Running the binary on a production server to observe behavior
  2. Emailing the binary to colleagues for opinions
  3. Deleting it and closing the ticket
  4. Static analysis of strings, imports, and hashes against threat intelligence Correct answer.

Explanation

Static analysis inspects the file without execution, and hash lookups against threat intelligence provide quick context. Running it on production risks compromise, and deleting it destroys evidence. Safe, non-executing analysis is preferred first.

Question 19Security Operations and Incident Response Fundamentals

What is the role of a sandbox in security operations?

  1. Blocking all outbound traffic permanently
  2. Detonating suspicious files in an isolated environment to observe behavior Correct answer.
  3. Storing backups of production databases
  4. Managing user password resets

Explanation

A sandbox executes suspicious artifacts in an isolated environment so analysts can observe behavior safely. It does not permanently block traffic, store backups, or manage passwords. Behavioral output enriches detection and response decisions.

Question 20Security Operations and Incident Response Fundamentals

An analyst discovers that an attacker used valid credentials rather than malware. Which detection strategy is most effective against this scenario?

  1. Monitoring printer toner levels
  2. Signature-based scanning of executable files only
  3. Behavioral analytics that flag anomalous access patterns and impossible travel Correct answer.
  4. Reviewing physical visitor logs only

Explanation

Credential-based intrusions evade file signatures, so behavioral analytics detecting anomalous access and impossible travel are more effective. Scanners, toner monitoring, and physical logs do not address account misuse. User and entity behavior analytics target this gap.

Question 21Security Operations and Incident Response Fundamentals

A team must decide whether an incident meets the threshold for regulatory breach notification. Which factor is most decisive?

  1. The brand of firewall deployed at the perimeter
  2. The seniority of the analyst who detected it
  3. The number of alerts generated during the incident
  4. Whether confirmed unauthorized access to regulated personal data occurred Correct answer.

Explanation

Notification obligations hinge on whether regulated personal data was accessed without authorization, which requires scoping and evidence. Alert counts, analyst seniority, and firewall brand do not determine legal thresholds. Legal and privacy teams should be engaged once data access is confirmed.

Question 22Security Operations and Incident Response Fundamentals

During a live intrusion, an analyst must choose between immediate eradication and continued monitoring. Which consideration most strongly favors continued monitoring?

  1. Pressure to reduce analyst workload
  2. A preference to delay all communication indefinitely
  3. The need to understand the full scope and all persistence mechanisms before removal Correct answer.
  4. A desire to avoid documenting the incident

Explanation

Delaying eradication can be justified when it allows the team to map full scope and identify all persistence, preventing the attacker from simply re-entering. Avoiding documentation, workload pressure, and indefinite communication delays are not valid reasons. This trade-off must be weighed against ongoing risk.

Question 23Security Operations and Incident Response Fundamentals

An analyst correlates a spike in outbound DNS queries to random subdomains of a single domain with periodic timing. Which technique is most likely in use?

  1. DNS tunneling used for command and control or exfiltration Correct answer.
  2. A routine software update check
  3. A legitimate content delivery network cache miss
  4. A misconfigured NTP server

Explanation

High-volume queries to random subdomains with regular timing are characteristic of DNS tunneling for command-and-control or data exfiltration. Update checks, NTP issues, and CDN cache misses do not produce this pattern. Analysts should inspect query entropy and payload size.

Question 24Security Operations and Incident Response Fundamentals

A post-incident review finds that an alert fired but was closed without investigation. Which improvement most directly addresses this root cause?

  1. Increasing the number of firewall rules
  2. Buying additional endpoint licenses
  3. Shortening log retention to reduce storage cost
  4. Revising triage procedures and adding quality review of closed alerts Correct answer.

Explanation

The failure was procedural, so revising triage steps and reviewing closed alerts addresses the root cause directly. Additional licenses, more firewall rules, or shorter retention do not correct mishandled triage. Lessons learned should translate into measurable process changes.

Question 25Security Operations and Incident Response Fundamentals

Which combination best describes a defensible approach to scoping a suspected data exfiltration incident?

  1. Rely solely on the initial alert text
  2. Correlate proxy, DNS, and endpoint logs to identify data flows and affected hosts Correct answer.
  3. Assume scope is limited to the first host identified
  4. Interview only the reporting user and close the case

Explanation

Scoping requires correlating multiple telemetry sources to identify all data flows and affected systems. Relying on a single alert, a single interview, or the first host risks missing additional compromise. Comprehensive scoping informs containment and notification decisions.

Question 26Security Operations and Incident Response Fundamentals

In an incident response plan, which phase immediately follows identification and is responsible for limiting the spread of an intrusion?

  1. Recovery
  2. Lessons learned
  3. Preparation
  4. Containment Correct answer.

Explanation

Containment is the phase where responders act to stop the incident from spreading to additional systems or data, for example by isolating hosts or blocking network paths. Recovery restores normal operations only after the threat is contained and removed.

Question 27Security Operations and Incident Response Fundamentals

Which data source is most useful for reconstructing the sequence of processes that executed on an endpoint during an intrusion?

  1. Physical access control logs
  2. DHCP lease records
  3. Firewall session logs
  4. Endpoint detection and response process telemetry Correct answer.

Explanation

EDR telemetry records process creation, parent-child relationships, and command lines, which is exactly what is needed to reconstruct execution chains. Network and access logs show connectivity or entry events but cannot show which binaries ran on the host.

Question 28Security Operations and Incident Response Fundamentals

What is the primary purpose of maintaining a chain of custody record for digital evidence?

  1. To accelerate the malware analysis workflow during triage
  2. To demonstrate that evidence was not altered or mishandled from collection to presentation Correct answer.
  3. To reduce the storage cost of forensic images
  4. To satisfy patch management reporting requirements

Explanation

Chain of custody documents who handled evidence, when, and how, establishing integrity so the evidence is defensible in legal or disciplinary proceedings. Without it, opposing parties can argue the evidence was tampered with or contaminated.

Question 29Security Operations and Incident Response Fundamentals

Which activity belongs to the preparation phase of the incident response lifecycle?

  1. Collecting volatile memory from a compromised server
  2. Notifying regulators of a confirmed data breach
  3. Eradicating malware from an infected host
  4. Establishing and testing the incident response plan with defined roles Correct answer.

Explanation

Preparation covers building the capability to respond: writing the plan, assigning roles, acquiring tools, and validating them through exercises. The other activities occur once an incident is already underway.

Question 30Security Operations and Incident Response Fundamentals

An analyst sees a host resolve a domain to an internal IP address that does not match the authoritative DNS record. Which technique is most likely in use?

  1. Normal round-robin DNS rotation
  2. DNS cache poisoning to redirect traffic to an attacker-controlled host Correct answer.
  3. A benign load balancer distributing traffic
  4. A scheduled DNS zone transfer

Explanation

When a resolver returns an internal address that differs from the authoritative record, forged or poisoned cache entries are a strong candidate, redirecting victims to attacker infrastructure. Load balancing and round-robin change addresses among legitimate records but do not contradict the authoritative zone.

Question 31Security Operations and Incident Response Fundamentals

A SOC wants alerts to fire only when a privileged account logs on outside approved maintenance windows. Which detection approach fits best?

  1. A volumetric threshold on outbound traffic
  2. A rule combining account privilege, logon event, and time-of-day conditions Correct answer.
  3. A periodic full vulnerability scan
  4. A signature matching known malware hashes

Explanation

The requirement is behavioral and contextual, so the rule must correlate identity attributes (privilege), event type (logon), and time context. Hash signatures, traffic volume, and vulnerability scans do not express the privilege-and-time condition.

Question 32Security Operations and Incident Response Fundamentals

During triage, an analyst must prioritize several concurrent alerts. Which factor most strongly justifies immediate escalation of one alert?

  1. The alert involves a domain controller and shows successful authentication from an unfamiliar external address Correct answer.
  2. The alert was generated by the newest detection rule in the library
  3. The alert originated from a host with an outdated antivirus definition
  4. The alert has the highest numeric severity label in the console

Explanation

Impact and evidence of success matter most: a domain controller is a high-value asset, and successful authentication from an unfamiliar external source suggests real compromise. Severity labels, rule recency, and stale definitions are contextual signals but do not by themselves demonstrate active compromise of critical infrastructure.

Question 33Security Operations and Incident Response Fundamentals

An analyst needs to preserve volatile evidence on a running Linux server before shutting it down. Which action is most appropriate first?

  1. Delete suspicious files to prevent reinfection
  2. Reboot the server to clear malicious processes
  3. Capture memory and running process information using a trusted, documented tool Correct answer.
  4. Reimage the server from a known-good backup

Explanation

Volatile data such as memory contents, network connections, and running processes disappears on shutdown, so it should be captured first with a trusted tool and documented procedure. Rebooting, deleting files, or reimaging destroys evidence needed for scoping and root cause.

Question 34Security Operations and Incident Response Fundamentals

An analyst finds that a user's mailbox rules silently forward messages containing invoice keywords to an external address. Which conclusion is best supported?

  1. The mail server is experiencing a routing misconfiguration
  2. The mailbox was likely configured by an attacker for email-based data collection Correct answer.
  3. The user is probably archiving messages to a personal backup service
  4. The forwarding is a normal function of the spam filter

Explanation

Hidden rules that forward only messages matching business keywords to an external mailbox are a recognized post-compromise persistence and collection technique. Legitimate archiving and spam filtering do not require covert keyword-based forwarding to an outside address.

Question 35Security Operations and Incident Response Fundamentals

Which control most directly reduces the blast radius of a compromised service account used by an application?

  1. Rotating the account password every 24 hours
  2. Increasing the password length for the service account
  3. Enabling verbose logging for the account
  4. Scoping the account's permissions to only the resources the application requires Correct answer.

Explanation

Blast radius is determined by what the credential is authorized to do, so restricting permissions to the minimum required limits damage if the account is misused. Password length, rotation, and logging help but do not reduce the resources an attacker can reach with a valid credential.

Question 36Security Operations and Incident Response Fundamentals

An analyst reviews proxy logs and sees a workstation upload a large volume of compressed data to a newly registered domain over HTTPS at a consistent nightly interval. Which hypothesis is best supported?

  1. Normal user browsing of a content delivery network
  2. Backup traffic to a corporate file share
  3. Routine operating system update downloads
  4. Scheduled exfiltration of collected data to attacker infrastructure Correct answer.

Explanation

Large outbound transfers of compressed content to a newly registered external domain on a fixed schedule matches staged exfiltration behavior. Updates, CDN browsing, and internal backups would involve known vendors or internal destinations rather than a new external domain.

Question 37Security Operations and Incident Response Fundamentals

Which practice most improves the usefulness of indicators of compromise shared between organizations?

  1. Sharing only file hashes because they never change
  2. Publishing indicators without timestamps to keep them timeless
  3. Removing all source attribution to protect privacy
  4. Adding context such as first-seen time, associated campaign, and confidence level Correct answer.

Explanation

Indicators age quickly and vary in reliability, so context like first-seen date, campaign linkage, and confidence lets consumers judge relevance and expiry. Stripping timestamps or attribution removes the information needed to assess and act on them.

Question 38Security Operations and Incident Response Fundamentals

An analyst must decide whether a suspicious login represents a compromised account or a traveling user. Which evidence combination most strongly supports compromise?

  1. Impossible-travel logins from two distant regions within minutes plus a new MFA device registration Correct answer.
  2. A single login from a new city during the user's approved vacation
  3. A password change initiated from the user's registered device
  4. A login from the user's usual office IP address

Explanation

Physically impossible travel combined with a new authenticator registration indicates an attacker who has obtained credentials and is enrolling their own second factor. A single new-city login during approved travel, a familiar office IP, and a change from a registered device are all consistent with legitimate use.

Question 39Security Operations and Incident Response Fundamentals

A responder must choose between wiping an infected host and keeping it online for monitoring. Which consideration is most decisive for selecting containment over continued observation?

  1. Whether the monitoring dashboard has capacity for more alerts
  2. Whether the host has active connections to production data stores holding regulated records Correct answer.
  3. Whether the responder prefers one tool over another
  4. Whether the host has an outdated asset inventory entry

Explanation

The decision hinges on potential impact: if the host can reach regulated production data, the risk of continued observation outweighs intelligence gain and containment should proceed. Tooling preferences, inventory hygiene, and dashboard capacity do not bear on the harm an active intrusion can cause.

Question 40Security Operations and Incident Response Fundamentals

After an incident, a review finds that responders had no agreed definition of which events require executive notification. Which improvement addresses the root cause most directly?

  1. Add more analysts to the on-call rotation
  2. Purchase an additional SIEM log source
  3. Shorten the alert retention period
  4. Define explicit escalation criteria and notification thresholds in the incident response plan Correct answer.

Explanation

The gap is a missing decision criterion, so the fix is to document escalation and notification thresholds with clear ownership and test them in exercises. Adding staff, logs, or changing retention does not tell responders when to notify leadership.

Question 41Threat Detection and Monitoring

In a SIEM correlation rule, which component defines the time window within which multiple matching events must occur to generate an alert?

  1. The log retention policy
  2. The asset criticality table
  3. The field extraction parser
  4. The aggregation or threshold clause Correct answer.

Explanation

Correlation rules typically combine a filter, a group-by, and an aggregation or threshold clause that specifies how many events must appear inside a defined time window. The window is part of the aggregation logic, not the parsing or retention settings.

Question 42Threat Detection and Monitoring

An analyst wants to detect a brute-force attempt against a Windows host. Which telemetry source most directly records failed authentication events with account and source information?

  1. DNS query logs
  2. Sysmon process creation events
  3. Windows Security event log Correct answer.
  4. Windows Application event log

Explanation

Failed logon attempts are recorded in the Windows Security log as event IDs 4625, which include the target account and source address. Application logs and DNS logs do not capture authentication failures of this kind.

Question 43Threat Detection and Monitoring

A detection engineer needs to identify beaconing behavior in proxy logs. Which analytic approach best surfaces regular, low-volume callbacks?

  1. List all destinations contacted more than once in a day
  2. Count total bytes per internal host and flag the top talkers
  3. Flag any connection to a newly registered domain
  4. Compute inter-arrival time variance per destination and flag low-variance periodic connections Correct answer.

Explanation

Beaconing is characterized by periodic callbacks, so measuring the variance of intervals between connections per destination reveals regularity that volume-based metrics miss. High-volume or one-time counts do not distinguish periodic from human-driven traffic.

Question 44Threat Detection and Monitoring

Which indicator most strongly suggests DNS tunneling rather than normal DNS resolution?

  1. High volume of TXT or NULL queries with long, high-entropy subdomain labels to one domain Correct answer.
  2. Occasional NXDOMAIN responses for mistyped internal hostnames
  3. Repeated A record queries for a popular CDN hostname
  4. Queries distributed evenly across many unrelated domains

Explanation

DNS tunneling encodes data in query names or record types, producing long high-entropy labels and unusual record types such as TXT or NULL directed at a single domain. Ordinary resolution uses short predictable names and common record types.

Question 45Threat Detection and Monitoring

In the MITRE ATT&CK framework, which tactic covers techniques such as credential dumping and keylogging?

  1. Collection
  2. Lateral Movement
  3. Credential Access Correct answer.
  4. Persistence

Explanation

Credential Access is the tactic describing techniques that steal account names and passwords, including credential dumping and input capture. Collection concerns gathering data, Lateral Movement concerns moving between hosts, and Persistence concerns maintaining access.

Question 46Threat Detection and Monitoring

A SOC receives a high volume of alerts from a single signature that repeatedly fires on benign administrative scripts. What is the most appropriate detection engineering response?

  1. Increase the alert severity so analysts prioritize it
  2. Disable the rule permanently to reduce noise
  3. Tune the rule with suppression or exclusion logic for the known benign pattern and document the change Correct answer.
  4. Route all alerts from the rule directly to the ticketing queue without triage

Explanation

Tuning with targeted exclusions removes the known false-positive driver while preserving detection coverage, and documenting the change maintains auditability. Disabling the rule removes coverage entirely, and escalating or auto-ticketing noise worsens analyst workload.

Question 47Threat Detection and Monitoring

Which log source is most useful for detecting lateral movement via remote service creation on Windows hosts?

  1. PowerShell operational log
  2. Windows Firewall log
  3. Print service operational log
  4. Security event 7045 recorded in the System log Correct answer.

Explanation

Event ID 7045 in the System log records a new service being installed, which is a common artifact of remote service creation used for lateral movement. Firewall and print logs do not capture service installation.

Question 48Threat Detection and Monitoring

An EDR alert shows a process invoking `vssadmin delete shadows /all /quiet`. Which behavior does this most directly indicate?

  1. Credential dumping from LSASS memory
  2. Ransomware attempting to delete volume shadow copies to prevent recovery Correct answer.
  3. Privilege escalation through token impersonation
  4. Persistence through a scheduled task

Explanation

Deleting volume shadow copies is a well-known ransomware precursor that removes local recovery options before encryption. It is not a credential, token, or persistence technique.

Question 49Threat Detection and Monitoring

Which approach best reduces false positives when detecting impossible-travel sign-ins?

  1. Correlate geolocation velocity with device fingerprint and known VPN or proxy ranges Correct answer.
  2. Alert on every sign-in from a country outside the user's home country
  3. Disable geolocation enrichment to avoid provider errors
  4. Alert whenever two sign-ins occur more than one hour apart

Explanation

Impossible-travel logic should account for VPN, proxy, and device context so that legitimate remote access does not trigger alerts. Naive country-based rules generate heavy false positives, and removing enrichment eliminates the signal entirely.

Question 50Threat Detection and Monitoring

A threat hunter wants to find hosts communicating with a known malicious IP that appears in threat intelligence. Which detection method is most direct?

  1. Compare baseline CPU usage per host
  2. Match outbound connection logs against the intelligence indicator list Correct answer.
  3. Review patch levels across the fleet
  4. Search for processes with unsigned binaries

Explanation

Indicator matching joins network telemetry against curated threat intelligence so connections to the known-bad address are surfaced directly. Patch review and CPU baselines are unrelated to the indicator.