Techniques

A SOC analyst is asked to detect previously unseen insider threats in authentication logs where no labeled examples of malicious behavior exist. Leadership wants an AI-powered analytic technique that can surface unusual login patterns without predefined signatures. Which technique should the analyst recommend?

A SOC lead wants to reduce the time analysts spend deciding which of thousands of daily alerts to investigate first. The team has years of historical incident data indicating which alerts previously led to confirmed incidents, along with contextual features (asset criticality, user role, time of day). Management asks the lead to recommend an AI-powered analytic technique that will automatically rank incoming alerts by their likelihood of being a genuine incident. Which technique best meets this need?

A SOC analytics team wants to predict the expected volume of authentication requests for each hour of the coming week so capacity and staffing can be planned, and so that unusual spikes can later be flagged against the forecast. Historical hourly authentication counts spanning two years are available. Which AI/ML technique should the team recommend to produce these numeric hourly predictions?

A financial services SOC has a large historical dataset of transactions, each already labeled by fraud analysts as either 'fraudulent' or 'legitimate.' Leadership wants an AI-powered analytic capability that can automatically assign one of these two categories to each new incoming transaction in real time. Which machine learning technique should you recommend to meet this specific need?

A SOC analyst at a large enterprise is overwhelmed by millions of unlabeled security events per day from firewalls, endpoints, and proxies. Leadership wants an AI-powered analytics approach that automatically groups related events into natural categories to surface previously unknown attack patterns and reduce alert volume — without requiring pre-defined labels or known signatures. Which AI-powered technique should the analyst recommend to meet this specific need?

A SOC lead is overwhelmed by the volume of unstructured threat intelligence reports, vendor advisories, and dark web forum posts arriving daily. She wants an AI-powered analytic technique that can automatically read this free-form text, extract key indicators and threat actor mentions, and produce concise summaries so analysts can triage faster. Which AI/ML technique best meets this specific need?

A security engineer has been tasked with hardening a fleet of newly deployed Ubuntu Linux servers before they enter production. Management wants the configuration baselines to follow an industry-recognized, consensus-developed standard that provides specific, prescriptive configuration settings and is freely available for reference. Which resource should the engineer use to obtain these prescriptive hardening guidelines?

During a hardening review of a production PostgreSQL database server, a SOC analyst discovers the host is also running an active SMTP relay, an FTP daemon, and the SNMP service with the default 'public' community string. The database application only requires inbound TCP 5432 from the application tier and outbound access to a patch repository. Following the principle of least functionality, which recommendation should the analyst make?

A security analyst is hardening a newly provisioned Linux web server that will only serve HTTPS traffic to the public internet. A port scan of the host reveals the following listening services: HTTPS (443), Telnet (23), FTP (21), SSH (22), and an unused SMTP relay (25). The organization requires remote administration to remain possible while eliminating unnecessary attack surface. Which services should the analyst disable to best harden this asset?

A security analyst is evaluating the controls of a manufacturing environment. During assessment, the analyst finds that endpoint antivirus is deployed and up to date, firewalls exist at the perimeter, and all servers are patched monthly. However, a recent penetration test showed that once a single workstation was compromised, the tester could reach the SCADA controllers, HR database, and financial systems without crossing any internal filtering point. Which control gap should the analyst prioritize in the improvement recommendation?

During a security controls assessment, an analyst finds that an enterprise deploys next-gen firewalls at the perimeter, EDR on all endpoints, and full inbound URL filtering. However, review of firewall logs shows that internal hosts can establish outbound HTTPS sessions directly to any external IP address without inspection. Two recent malware incidents used encrypted outbound channels to reach command-and-control servers undetected. Which control gap should the analyst prioritize recommending to close this weakness?

During a security control evaluation, an analyst finds that the company's remote-access VPN authenticates users with only a username and password. Credential-stuffing attacks against the VPN portal have already led to two unauthorized logins in the past quarter. Which recommendation most directly closes the diagnosed control gap?

A security analyst is tasked with evaluating the security posture of a newly deployed application server. The server team insists the host is fully patched, but the analyst wants the most accurate picture of missing patches and risky local configuration settings, including registry values and installed software versions. Which assessment approach should the analyst recommend to obtain this level of detail?

A security engineer is tasked with evaluating the security posture of a fleet of newly commissioned Linux web servers. The organization has an approved secure configuration baseline documented in its policy. The engineer wants to determine which servers deviate from the mandated settings (e.g., password policy, disabled services, file permissions, audit logging) without relying solely on generic vulnerability CVE detection. Which assessment approach BEST meets this specific need?

A security analyst is asked to evaluate the security posture of a newly acquired company's public-facing customer portal server before it is integrated into the corporate network. The analyst has network access to the host but no documentation about its configuration, installed software, or exposure. Which action should the analyst perform FIRST to begin evaluating the asset's security posture?

A security engineer is asked to reduce the effort of securing hundreds of newly provisioned virtual servers that developers spin up daily. Each new server currently requires manual application of the OS baseline, removal of unnecessary packages, and configuration of logging before it can be approved for production. What approach best addresses this need while ensuring consistency across all deployments?

A cloud engineering team plans to deploy a fleet of identical Linux web servers using an auto-scaling group that launches new instances from a single base machine image whenever load increases. The security team is asked to make a recommendation that ensures every newly launched instance already meets the organization's security standard the moment it comes online, without manual intervention after boot. Which recommendation best meets this need?

A security engineer is hardening a corporate LAN where contractors and employees connect their laptops to the same physical switch ports in shared workspaces. The engineer must ensure that only devices meeting corporate posture requirements (updated antivirus, current patches, corporate certificate) are permitted onto the internal VLAN, while non-compliant or unknown devices are placed in a restricted remediation VLAN. Which network control best meets this requirement?

A SOC analyst is hardening the enterprise network against malware that relies on domain-generation algorithms (DGAs) to reach command-and-control infrastructure. The security team wants a network control that not only blocks resolution of known malicious domains but also automatically redirects the infected host's queries so that the compromised endpoints can be identified from the DNS resolver logs. Which network control best meets both requirements?

A retail company offers free Wi-Fi to customers. During a security review, an analyst discovers that guest wireless clients can reach the corporate point-of-sale (POS) VLAN and the internal file server VLAN. The business requires that guests retain internet access but be prevented from reaching any internal corporate resources. Which network control most directly addresses this requirement?