Certified SOC Analyst Free Sample Questions

The most critical immediate step is to understand what the PowerShell command is attempting to do. Blocking the IP or isolating the host are containment actions that should be taken, but not before gaining context. Without understanding the payload, the analyst cannot determine the scope or severity of the incident. Decoding the Base64 string from the full log entry will reveal the actual commands being executed, providing the necessary intelligence to guide subsequent containment and eradication steps.

Modern attackers rarely use plain-text SQL injection strings. They employ various encoding techniques (URL encoding, Base64, etc.) and obfuscation methods to bypass simple string-matching rules. A rule that only looks for literal strings like 'UNION SELECT' is trivial to evade and will result in a high number of false negatives (missed attacks). A more effective rule would need to look for patterns, special characters, or use more advanced analytics that can decode and normalize log data before inspection.

PsExec works by installing a temporary service (PSEXESVC) on the remote machine to execute commands. This action generates a 'A service was installed in the system' event with Event ID 4697 in the Windows Security Log on the target host. Searching for this specific event across multiple workstations is a high-fidelity method for detecting PsExec usage. While firewall logs show the necessary SMB traffic, they don't confirm what the traffic is for. DNS logs are too generic. Process creation logs on the source machine would show psexec.exe running, but logs on the target machine provide definitive proof of the lateral movement.

MTTD measures the time from when an attack occurs until it is detected. A rising MTTD indicates a problem with the detection capabilities. This is often caused by poorly tuned SIEM rules, outdated threat intelligence, or gaps in log source coverage, leading to alerts being missed or delayed. Since MTTR (the time from detection to resolution) is stable, it means the response team is performing their job effectively once an incident is identified. Therefore, the problem lies in the detection phase, not the response phase.

True. According to the Lockheed Martin Cyber Kill Chain model, the 'Installation' phase, where malware establishes persistence on the victim's system, precedes the 'Command and Control' (C2) phase. During the C2 phase, the installed malware 'calls home' to the attacker's infrastructure to receive instructions. Persistence must be established first to ensure the C2 channel can be maintained.

The Eradication phase of the incident response lifecycle focuses on completely removing the threat from the environment. This includes deleting the malware, removing persistence mechanisms (like registry keys or scheduled tasks), and eliminating any other tools or backdoors left by the attacker. Isolation is part of Containment, restoring data is part of Recovery, and lessons learned is the final post-incident phase.

This query correctly filters for the specific Windows event for a successful logon (EventCode=4624), then uses the iplocation command to enrich the events with geographic data based on the source IP address (src_ip). Finally, it uses a search command to filter those enriched events to show only those where the Country field is not equal to 'US'. The other options are incorrect or less efficient.

A data tiering strategy is the industry-standard solution for balancing performance and cost in long-term log retention. Logs are kept in expensive, high-performance 'hot' storage for a short period (e.g., 30-90 days) for immediate analysis. After that, they are moved to cheaper, slower 'warm' or 'cold' storage (like AWS S3 Glacier or an on-premise NAS). This meets the compliance requirement for retention without the exorbitant cost of keeping all data in hot storage. Data can still be re-ingested or queried from cold storage if needed for a forensic investigation, albeit more slowly.

This scenario describes a specific Tactic, Technique, and Procedure (TTP). The tactic is 'Persistence' or 'Defense Evasion', the technique is 'Valid Accounts', and the specific procedure is the use of a dormant account to access resources. An IoC is the evidence itself (e.g., the log entry), not the methodology. Zero-day and DoS are types of attacks, but the concept of using a dormant account is a classic TTP employed by attackers to blend in and avoid detection.