Which SOC analyst tier is primarily responsible for the initial triage and validation of incoming alerts?
Csa Security Operations
Question · Easy
Don't pull the plug: the order of volatility
Short
Which three pillars form the foundation of effective SOC operations?
Introduction: Current Exam Facts and Blueprint
0.1 Current Exam Facts, Blueprint, and Study Plan
Study guide
An organization wants to retain control over its security data and analysts but does not want to manage SIEM infrastructure. Which SOC model best fits this requirement?
Question · Medium
Tech Exam Prep Podcast
Listen on Spotify
Podcast
Which SOC KPI measures the average time between when an incident occurs and when it is detected?
At which SOC maturity level does the organization establish formal documentation, repeatable processes, and consistent metrics, but still relies on manual analyst work?
Question · Hard
AWS or YOU?
An attacker uses ARP spoofing to position themselves between a victim and the gateway. Which type of attack is this?
Csa Cyber Threats
Chapter 1: Security Operations and Management Fundamentals
1.1 SOC Overview, Capabilities, and Operational Workflow
Which of the following is an Indicator of Compromise (IoC) rather than an Indicator of Attack (IoA)?
In the MITRE ATT&CK framework, which tactic covers techniques attackers use to maintain access to a system across reboots?
Which stage of the Lockheed Martin Cyber Kill Chain involves delivering the malicious payload to the target via email, USB, or compromised website?
An employee with legitimate access copies sensitive files to a USB drive on their last day before resigning. Which threat category does this represent?
1.2 SOC Architectures, Sourcing Models, and Organizational Components
A SOC analyst observes a phishing email with a sender domain that visually resembles the company's domain (e.g., 'c0mpany.com' instead of 'company.com'). Which technique is the attacker using?
Which type of social engineering attack specifically targets high-value executives such as CFOs and CEOs?
An attacker exploits a vulnerable web application by injecting `' OR '1'='1` into a login form. Which application attack is occurring?
Which Windows event ID indicates a successful interactive logon?
Csa Log Management
1.3 SOC Maturity, Generations, Metrics, and KPIs
A SOC analyst sees a spike in Windows Event ID 4625 from a single source IP across many usernames. What attack is most likely occurring?
Which Sysmon event ID logs new process creation with command-line and parent process details?
Which Linux log file typically contains authentication-related events including SSH logins on Debian/Ubuntu systems?
Which port and protocol does standard syslog use for centralized log forwarding?
Chapter 2: Cyber Threat Vectors, TTPs, and Attack Techniques
2.1 Network, Host, and Password Attack Techniques
A firewall log shows: action=DENY, src_ip=203.0.113.5, dst_port=3389, count=1500 in 60 seconds. What is the most likely activity?
In an Apache web server access log, which HTTP status code in a sudden spike most strongly suggests a directory enumeration / forced-browsing attack?
Which log source provides the best visibility into DNS-based command and control or exfiltration?
When configuring centralized logging for a Windows domain, which agent or mechanism is commonly used to forward logs to a SIEM?
2.2 Application, Web, and Session Attack Vectors
A SOC analyst needs to verify a database access event for a compliance audit. Which database log is most relevant?
An email gateway log records SPF=fail and DMARC=fail for an inbound message claiming to be from the company's CFO. What action should the SOC take?
Which Windows event IDs are most relevant to detect Kerberoasting attacks?
Which property of centralized logging directly addresses the requirement that log integrity must be verifiable for forensic and legal use?
2.3 Social Engineering, Email Threats, and Insider Attacks
What is the primary advantage of normalizing log data into a common schema (e.g., ECS or CIM) at SIEM ingestion?
Which router log feature is essential for detecting unauthorized configuration changes after-the-fact?
What is the primary function of a SIEM in a Security Operations Center?
Csa Siem Detection
In Splunk, which command is used to enrich events with data from a CSV lookup table at search time?
Chapter 3: Threat Frameworks, Methodologies, and Indicators
3.1 Indicators of Compromise (IoCs), Indicators of Attack (IoAs), and Pyramid of Pain
An on-premises SIEM is preferred over a cloud-hosted SIEM in which scenario?
Which SIEM correlation rule type fires when a specific number of events of a given type occur within a defined time window from the same source?
A SIEM use case requires alerting on a successful logon (4624) from a country the user has never logged in from before. Which detection technique does this represent?
Which SIEM data ingestion architecture component is responsible for parsing raw logs into structured fields at ingestion time?
3.2 Cyber Kill Chain and Diamond Model of Intrusion Analysis
An IBM QRadar SOC analyst sees an Offense flagged with magnitude 8. What does the magnitude represent?
Which open-source SIEM stack is most commonly described by the acronym ELK?
Loading more…