NO.114 The SOC team is investigating a phishing attack that targeted multiple employees. During the Containment Phase, they need to determine how users interacted with the malicious email: whether they opened it, clicked links, downloaded attachments, or entered credentials. This information is critical to assessing impact and preventing further compromise. Which specific activity helps the SOC team understand user interactions with the phishing email?

NO.115 John, SOC analyst wants to monitor the attempt of process creation activities from any of their Windows endpoints.
Which of following Splunk query will help him to fetch related logs associated with process creation?

NO.116 What does HTTPS Status code 403 represents?

NO.117 Mike is an incident handler for PNP Infosystems Inc. One day, there was a ticket raised regarding a critical incident and Mike was assigned to handle the incident. During the process of incident handling, at one stage, he has performed incident analysis and validation to check whether the incident is a true incident or a false positive.
Identify the stage in which he is currently in.

NO.118 Which of the following event detection techniques uses User and Entity Behavior Analytics (UEBA)?

NO.119 A SOC team notices malware-related incidents increased over the past six months, primarily targeting endpoints through phishing campaigns. They need to present a report to security leadership to justify investing in advanced email filtering and end-user security training. Which SOC report best supports their case?

NO.120 A type of threatintelligent that find out the information about the attacker by misleading them is known as
.

NO.121 A type of threat intelligent that find out the information about the attacker by misleading them is known as
.

NO.122 Identify the password cracking attempt involving a precomputed dictionary of plaintext passwords and their corresponding hash values to crack the password.

NO.123 According to the Risk Matrix table, what will be the risk level when the probability of an attack is very low and the impact of that attack is major?

NO.124 Rinni, SOC analyst, while monitoring IDS logs detected events shown in the figure below.

What does this event log indicate?

NO.125 Identify the password cracking attempt involving a precomputed dictionary of plaintext passwords and their corresponding hash values to crack the password.

NO.126 In which phase of Lockheed Martin’s – Cyber Kill Chain Methodology, adversary creates a deliverable malicious payload using an exploit and a backdoor?

NO.127 A large financial institution receives thousands of security logs daily from firewalls, IDS systems, and user authentication platforms. The SOC uses an AI-driven SIEM system with Natural Language Processing (NLP) capabilities to streamline threat detection. This enables faster response times, reduces manual rule creation, and helps detect advanced threats that traditional systems might overlook. Which option best illustrates the advantage of NLP in SIEM?

NO.128 A SIEM alert is triggered due to unusual network traffic involving NetBIOS. The system log shows: “The TCP/IP NetBIOS Helper service entered the running state.” Concurrently, Windows Security Event ID 4624 (“An account was successfully logged on”) appears for multiple machines within a short time frame. The logon type is 3 (Network logon). Which of the following security incidents is the SIEM detecting?

NO.129 Which of the following formula represents the risk?

NO.130 Daniel is a member of an IRT, which was started recently in a company named Mesh Tech. He wanted to find the purpose and scope of the planned incident response capabilities.
What is he looking for?

NO.131 An attacker exploits the logic validation mechanisms of an e-commerce website. He successfully purchases a product worth $100 for $10 by modifying the URL exchanged between the client and the server.
Original
URL: http://www.buyonline.com/product.aspx?profile=12
&debit=100
Modified URL: http://www.buyonline.com/product.aspx?profile=12
&debit=10
Identify the attack depicted in the above scenario.

NO.132 What does the HTTP status codes 1XX represents?

NO.133 Bonney’s system has been compromised by a gruesome malware.
What is the primary step that is advisable to Bonney in order to contain the malware incident from spreading?

NO.134 A security analyst in a multinational corporation’s Threat Intelligence team is tasked with enhancing detection of stealthy malware infections. During an investigation, the analyst observes an unusually high volume of DNS requests directed toward domains that follow patterns commonly associated with Domain Generation Algorithms (DGAs). Recognizing that these automated domain queries could indicate malware attempting to establish communication with command-and-control (C2) infrastructure, the analyst realizes existing detection may be insufficient. The security team needs to define intelligence requirements, including identifying critical data sources, refining detection criteria, and improving monitoring strategies. Which stage of the Cyber Threat Intelligence (CTI) process does this align with?

NO.135 Robin, a SOC engineer in a multinational company, is planning to implement a SIEM. He realized that his organization is capable of performing only Correlation, Analytics, Reporting, Retention, Alerting, and Visualization required for the SIEM implementation and has to take collection and aggregation services from a Managed Security Services Provider (MSSP).
What kind of SIEM is Robin planning to implement?

NO.136 Which of the following fields in Windows logs defines the type of event occurred, such as Correlation Hint, Response Time, SQM, WDI Context, and so on?

NO.137 John, a SOC analyst, while monitoring and analyzing Apache web server logs, identified an event log matching Regex /(.|(%|%25)2E)(.|(%|%25)2E)(/|(%|%25)2F|\|(%|%25)5C)/i.
What does this event log indicate?