Security Operations and Incident Response Flashcards

Which MITRE ATT&CK tactic describes an adversary's attempts to steal credentials from the target environment?

Answer: Credential Access

The Credential Access tactic in MITRE ATT&CK covers techniques used to steal credentials such as account names and passwords, including credential dumping and keylogging.

Which technology allows a SOC to automatically respond to low-confidence alerts by enriching them with threat intelligence before escalation?

Answer: Security Orchestration, Automation, and Response (SOAR)

SOAR platforms automate alert triage workflows, enriching events with threat intelligence lookups, asset data, and historical context before presenting them to analysts.

A compromised server is communicating with a C2 server using HTTPS on port 443. Which detection method is MOST effective?

Answer: TLS inspection with certificate validation and JA3 fingerprinting for anomalous clients

TLS inspection decrypts traffic for analysis, and JA3 fingerprinting identifies malicious client TLS configurations used by specific malware families even over encrypted channels.

Which artifact should be collected FIRST when responding to a Linux system compromise, given the order of volatility?

Answer: Running process list and network connections

Running processes and active network connections are the most volatile artifacts, existing only in memory and disappearing on reboot — they must be captured before any other action.

Which technique do attackers use to evade time-based detection by delaying malware execution until after security monitoring windows?

Answer: Scheduled task execution with time-based triggers

Attackers use scheduled tasks or sleep timers to delay execution until a period of reduced monitoring (e.g., nights, weekends), evading behavior-based detection that correlates events with deployment times.

A CASP+ professional is defining KPIs for the SOC. Which metric BEST measures the effectiveness of the detection capability?

Answer: Mean time to detect (MTTD) for confirmed incidents

MTTD measures how quickly the SOC identifies confirmed incidents from the point of initial compromise, directly reflecting the effectiveness of detection tools and analyst skill.