SOC Monthly Quiz

A user reports receiving a suspicious email containing a link prompting them to enter their credentials. What is the FIRST step in investigating this phishing attempt?

• Analyze the email headers for sender details and authentication records

• Immediately block the user’s account

• Click the link to check where it leads

• Ask the user to reply to the email for verification

A user reports that all their files have been encrypted with the .locked extension, and a ransom note is present. What is the IMMEDIATE action to take?

• Pay the ransom to retrieve the files

• Re-image the device

• Ask the user to rename the encrypted files

• Disconnect the infected machine from the network

Your IDS detects multiple SQL injection attempts on a public-facing web server. What is the BEST response?

• Upgrade the server hardware

• Upgrade rule on WAF

• Review web server logs and check for signs of successful exploitation

• Block IP to prevent SQL attacks

What does the command
netsh advfirewall set allprofiles state off
do?

• It blocks all incoming and outgoing traffic by setting the firewall to its strictest mode.

• It turns off the Windows Defender Firewall for all network profiles (Domain, Private, and Public).

• It disables only the Domain profile of Windows Firewall, leaving Private and Public profiles active.

• It resets the firewall rules to their default settings without disabling the firewall.

A brute-force attack has been detected against an exposed RDP server. What is the BEST mitigation strategy?

• Disable failed login alerts in the SIEM to reduce noise from brute-force attempts.

• Add the attacker’s IP to a global "safe list" to monitor their activity.

• Block the attacker's IP, enforce account lockout policies, and enable multi-factor authentication (MFA).

• Change the RDP port from 3389 to a random high-number port to evade attackers

Your DLP (Data Loss Prevention) alerts show large data uploads to a cloud storage service. What is the next step of action?

• Review SIEM and proxy logs to confirm the source, destination, and nature of the data transfer.

• Contact the employee FLM directly and ask them to explain their activity.

• Disable all outbound internet access to prevent further uploads.

• Immediately block the user’s account

Your SIEM system has flagged an alert indicating a high volume of failed login attempts followed by a successful login to an internal system using a corporate user's credentials. The account owner reports they did not attempt to log in, and the login was from an unrecognized IP address. What should be your FIRST course of action to mitigate the ATO attack?

• Reset the password for all users in the organization to prevent widespread compromise.

• Immediately lock the account, force a password reset, and review the account's recent activity.

• Notify the account owner to change their password immediately and continue monitoring the account for further activity.

During a routine security audit, you notice an unusual PowerShell script running on a Windows system. The script appears to be Base64-encoded and is being executed from a temporary directory. What is your FIRST course of action?

• Immediately block all PowerShell execution on the system to stop potential malicious actions.

• Notify the user to stop running PowerShell scripts, as it may be a common user mistake.

• Decode the Base64 script, review its content, and analyze its behavior in a sandbox environment.

• Restart the system and clear the temporary directory to remove traces of the script.

You notice that there are several authentication methods configured in the /etc/ssh/sshd_config file, including:
PasswordAuthentication yes
PubkeyAuthentication yes
ChallengeResponseAuthentication yes
The server is currently accessible by using a password and public key. You are concerned about the security of the password-based authentication method. What should be your FIRST course of action to improve security?

• Disable PubkeyAuthentication and rely solely on password-based authentication for simplicity.

• Disable ChallengeResponseAuthentication and rely on password authentication only.

• Disable Password Authentication and enforce the use of public key authentication only.

• Modify the /etc/ssh/sshd_config file to allow only Challenge-Response authentication

Which of the following is considered a false positive in security monitoring?

• An alert indicating a successful brute-force login attack when there was none

• An alert about unusual traffic that is determined to be caused by a DDoS attack

• An alert indicating malware detected in a sandbox environment

• An alert indicating a legitimate login attempt by an authorized user