SOC Analyst Certification Review - Practice Questions

Flashcards based on SOC Analyst practice scenarios, covering SIEM deployment, incident response phases, Windows event codes, and threat intelligence types.

Lateral movement

A security incident identified by unusual network traffic involving NetBIOS, concurrent Event Code $4624$ (Network logon type $3$), and multiple account logons within a short time frame.

Output-driven approach

A SIEM deployment strategy that begins with specific use cases to address high-priority concerns, allowing for the creation of complex use cases with greater scope and fewer false positives.

False Negative

An alert classification where a security incident occurs, such as an attacker bypassing a threshold by logging in on the $9^{th}$ attempt of a $10$-attempt limit, but the SIEM fails to generate an alert.

Cloud Access Security Broker (CASB)

A technology used by Cloud SOC teams to enforce access policies, monitor data sharing across SaaS, PaaS, and IaaS, and prevent sensitive data exposure.

Managed Detection and Response (MDR)

A service that provides proactive threat hunting and incident containment, suitable for organizations lacking an internal SOC but requiring rapid response capabilities.

Deprovisioning Users SOAR Playbook

A SOAR playbook designed to automate initial response and restrict access when an account is suspected of compromise due to unusual activity, such as logins from a different country.

Net Flow (RFC 3954)

The protocol used to collect IP traffic information from network devices like routers and switches to detect data exfiltration and traffic spikes.

Comma-Separated Values (CSV) Format

A structured or semi-structured log storage format that organizes data in a text file using a tabular structure for efficient parsing and analysis.

Extended Log Format (ELF)

A standardized web server log format used to capture detailed records including remote host, username, timestamp, requested resource, HTTP status code, and user-agent.

Containment

The phase of the Incident Response process focused on limiting the scope of an incident, such as isolating a VLAN to prevent the spread of LockBit ransomware.

Playbooks

The component of Microsoft Sentinel used to create automated workflows for tasks such as log collection, alert triaging, and notifications.

Static analysis

A malware analysis technique used to understand the functionality of a script, such as an embedded PowerShell script, without executing it.

Log normalization

The process of converting logs from heterogeneous sources with different formats into a common format to improve incident detection and response times.

Amazon GuardDuty

A fully managed AWS security service that monitors for malicious activity by analyzing AWS CloudTrail logs, VPC Flow Logs, and DNS query logs.

Vulnerable and Outdated Components

A risk classification for web applications that continue to rely on third-party libraries flagged for exploits, especially when patches have been rolled back.

Malware Disassembly

The process of analyzing a trojan's binary code at the instruction level without execution to identify its persistence mechanisms and backdoor functionalities.

Session Poisoning

An attack vector investigated by assessing cookie attributes like HttpOnly, Secure, and SameSite for security weaknesses alongside anomalous request patterns.

User action verification

A specific activity within the Containment Phase of a phishing attack investigation used to determine how users interacted with malicious links or attachments.

Centralized logging

A solution that aggregates security logs from multiple remote locations into a unified system to enable faster incident correlation and response.

Incident Coordinator

The role responsible for serving as the central point of communication between departments like Legal and HR and external providers during a data breach.

Eradication

The Incident Response phase where the root cause is addressed, such as applying emergency patch KB5025941 to a mail server exploited by ransomware.

Strategic Threat Intelligence

Intelligence focused on high-level risks, geopolitical threats, and emerging cybercriminal strategies that have long-term implications for security posture.

MITRE D3FEND Framework

A structured framework that maps defensive techniques to known adversarial tactics to help anticipate and mitigate evolving threats.

logging_collector

The specific configuration parameter enabled in PostgreSQL to ensure failed authentication attempts and database errors are captured for monitoring.

Syslog Relay

An intermediate component in a syslog infrastructure that receives log messages from various devices and forwards them to a central syslog server.

Chain of Custody

A detailed record tracking every individual who handled evidence, including storage locations and timestamps of transfers during a forensic investigation.

TAXII data connector

A Microsoft Sentinel connector used to integrate threat intelligence feeds using a standardized industry protocol.

Post-incident Activities

The phase of incident response that includes review meetings, calculating business impact (e.g., $\text{USD }157,000$), and identifying critical improvements.

Recovery

The phase of incident response involving the restoration of data, such as restoring $2.3\,\text{TB}$ of data from Veeam backups and rebuilding workstations.

Grok Filters

An automated log parsing technique used to transform unstructured logs into a structured format to enable efficient querying and analysis.

Actions on Objectives

The phase of the Cyber Kill Chain where an attacker moves laterally and exfiltrates sensitive client records over an extended period.

Structured Hunting

A threat-hunting approach used to identify Indicators of Attack (IoAs) by mapping observations against known adversary behaviors.

Anomaly-based detection

A detection method that identifies deviations from a baseline, such as an outbound traffic spike from $5\,\text{MB/hour}$ to over $500\,\text{MB}$ within $10$ minutes.

Event Code 5140

A Windows Security Event ID specifically used to monitor file sharing across a network.

Event Code 4656

A Windows security event that is logged every time a user attempts to access a Registry key.

Event Code 4740

The Windows event ID indicating that a user account has been locked out.

Weaponization

The phase of the Cyber Kill Chain methodology where an adversary creates a deliverable malicious payload using an exploit and a backdoor.

Black Hole Filtering

The process of discarding packets at the routing level without informing the source that the data did not reach its intended destination.

Parameter Tampering Attack

An attack where the logic validation mechanisms of a website are exploited by modifying URL parameters, such as changing a debit value from $100$ to $10$.

EPS (Events Per Second)

A performance metric calculated using the formula: $EPS = \text{number of security events} / \text{time in seconds}$.

DNS tunneling

A technique for data exfiltration where an internal host sends DNS queries with long, encoded subdomains and TXT records to an external domain.

Risk Level Formula

A calculation used to determine threat severity: $\text{Level of risk} = \text{Consequence} \times \text{Likelihood}$.

HTTP Status Code 403

An HTTP response status code signifying a Forbidden Error.

Directory Traversal Attack

A web exploit categorized by an attacker manipulating a URL to access files like /etc/passwd outside the web server's root directory.

Syslog Level 0

The highest severity level in Syslog messages, representing an Emergency condition.

Egress Filtering

A security technique that scans headers of IP packets leaving a network to ensure unauthorized or malicious traffic does not exit the internal environment.

Rainbow Table Attack

A password cracking method involving a precomputed dictionary of plaintext passwords and their corresponding hash values.

Incident Triage

The stage of incident handling where an analyst performs analysis and validation to determine if an event is a true incident or a false positive.