SY0-601 Operations & Incident Response 4 — Questions and Answers
Question 1: Which log source would BEST help identify a successful privilege escalation on a Windows system?
- DNS query logs
- Windows Security Event Logs (Event ID 4672) (Correct answer)
- Web server access logs
- DHCP lease logs
Correct answer: Windows Security Event Logs (Event ID 4672)
Windows Security Event ID 4672 (Special Logon) is generated when a user logs on with administrative or sensitive privileges, indicating privilege escalation.
Question 2: What is the difference between an incident and an event in security operations?
- They are identical terms
- An event is any observable occurrence; an incident is an event with negative security impact (Correct answer)
- An incident is routine; an event is always malicious
- Events only occur in cloud environments
Correct answer: An event is any observable occurrence; an incident is an event with negative security impact
An event is any observable system activity, while an incident is specifically an event that threatens the confidentiality, integrity, or availability of information.
Question 3: A security team is performing root cause analysis after a ransomware attack. Which artifact would MOST help identify the initial infection vector?
- The ransom note file
- Email server logs and web proxy logs (Correct answer)
- The encrypted file listing
- Current CPU usage metrics
Correct answer: Email server logs and web proxy logs
Email logs and web proxy logs reveal what was received and browsed before the infection, helping identify the phishing email or malicious download that started the attack.
Question 4: Which technique involves using decoy systems to detect and analyze attacker behavior?
- Penetration testing
- Honeypot deployment (Correct answer)
- Vulnerability scanning
- Red team engagement
Correct answer: Honeypot deployment
Honeypots are intentionally vulnerable decoy systems that lure attackers, allowing defenders to observe their tactics, techniques, and procedures.
Question 5: During eradication, a responder discovers malware persistence via a scheduled task. What is the BEST next step?
- Disable the network card
- Delete the scheduled task and scan for additional persistence mechanisms (Correct answer)
- Reboot the server immediately
- Notify law enforcement
Correct answer: Delete the scheduled task and scan for additional persistence mechanisms
Removing the malicious scheduled task and then scanning for other persistence methods ensures the threat is fully eradicated before recovery begins.
Question 6: Which type of threat intelligence sharing model allows organizations to exchange structured threat data using a standard format?
- STIX/TAXII (Correct answer)
- SNMP/MIB
- LDAP/AD
- SMTP/DMARC
Correct answer: STIX/TAXII
STIX (Structured Threat Information eXpression) defines the format and TAXII (Trusted Automated eXchange of Intelligence Information) is the transport protocol for sharing threat intelligence.
Question 7: A company's IRP requires notifying affected users within 72 hours of a confirmed breach. This requirement is MOST likely driven by:
- Internal IT policy
- GDPR or similar data breach notification regulations (Correct answer)
- The organization's SLA with its ISP
- NIST SP 800-61 recommendations
Correct answer: GDPR or similar data breach notification regulations
The 72-hour breach notification window is a specific legal requirement under GDPR and similar data protection regulations, not just a best-practice recommendation.
SY0-601 Operations & Incident Response 4
Which log source would BEST help identify a successful privilege escalation on a Windows system?