SOC Monthly quiz

A user reports receiving a suspicious email containing a link prompting them to enter their credentials. What is the FIRST step in investigating this phishing attempt?

• Immediately block the user’s account

• Click the link to check where it leads

• Ask the user to reply to the email for verification

• Analyze the email headers for sender details and authentication records

A user reports that all their files have been encrypted with the .locked extension, and a ransom note is present. What is the IMMEDIATE action to take?

• Pay the ransom to retrieve the files

• Disconnect the infected machine from the network

• Run a full antivirus scan while keeping the system online

• Ask the user to rename the encrypted files

Your IDS detects multiple SQL injection attempts on a public-facing web server. What is the BEST response?

• Review web server logs and check for signs of successful exploitation

• Contact the attacker to negotiate

• Upgrade the server hardware

• Block IP to prevent SQL attacks

What does the command
netsh advfirewall set allprofiles state off
do?

• It turns off the Windows Defender Firewall for all network profiles (Domain, Private, and Public).

• It disables only the Domain profile of Windows Firewall, leaving Private and Public profiles active.

• It blocks all incoming and outgoing traffic by setting the firewall to its strictest mode.

• It resets the firewall rules to their default settings without disabling the firewall.

A brute-force attack has been detected against an exposed RDP server. What is the BEST mitigation strategy?

• Block the attacker's IP, enforce account lockout policies, and enable multi-factor authentication (MFA).

• Change the RDP port from 3389 to a random high-number port to evade attackers.

• Disable failed login alerts in the SIEM to reduce noise from brute-force attempts.

• Add the attacker’s IP to a global "safe list" to monitor their activity.

Your DLP (Data Loss Prevention) alerts show large data uploads to an unauthorized cloud storage service. What should you do FIRST?

• Immediately block the user’s account and delete all transferred files from the cloud provider.

• Contact the employee FLM directly and ask them to explain their activity.

• Disable all outbound internet access to prevent further uploads.

• Review SIEM and proxy logs to confirm the source, destination, and nature of the data transfer.

Your SIEM system has flagged an alert indicating a high volume of failed login attempts followed by a successful login to an internal system using a corporate user's credentials. The account owner reports they did not attempt to log in, and the login was from an unrecognized IP address. What should be your FIRST course of action to mitigate the ATO attack?

• Immediately lock the account, force a password reset, and review the account's recent activity.

• Notify the account owner to change their password immediately and continue monitoring the account for further activity.

• Reset the password for all users in the organization to prevent widespread compromise.

During a routine security audit, you notice an unusual PowerShell script running on a Windows system. The script appears to be Base64-encoded and is being executed from a temporary directory. What is your FIRST course of action?

• Decode the Base64 script, review its content, and analyze its behavior in a sandbox environment.

• Notify the user to stop running PowerShell scripts, as it may be a common user mistake.

• Restart the system and clear the temporary directory to remove traces of the script.

• Immediately block all PowerShell execution on the system to stop potential malicious actions.

You notice that there are several authentication methods configured in the /etc/ssh/sshd_config file, including:

PasswordAuthentication yes

PubkeyAuthentication yes

ChallengeResponseAuthentication yes

The server is currently accessible by using a password and public key. You are concerned about the security of the password-based authentication method. What should be your FIRST course of action to improve security?

• Disable PasswordAuthentication and enforce the use of public key authentication only.

• Disable PubkeyAuthentication and rely solely on password-based authentication for simplicity.

• Disable ChallengeResponseAuthentication and rely on password authentication only.

• Modify the /etc/ssh/sshd_config file to allow only Challenge-Response authentication

Which of the following is considered a false positive in security monitoring?

• An alert indicating a successful brute-force login attack when there was none

• An alert about unusual traffic that is determined to be caused by a DDoS attack

• An alert indicating malware detected in a sandbox environment

• An alert indicating a legitimate login attempt by an authorized user