SY0-601 Operations & Incident Response 4

Question 1

Which log source would BEST help identify a successful privilege escalation on a Windows system?

Accepted Answer

Windows Security Event Logs (Event ID 4672)

Answer

Windows Security Event ID 4672 (Special Logon) is generated when a user logs on with administrative or sensitive privileges, indicating privilege escalation.

Question 2

What is the difference between an incident and an event in security operations?

Accepted Answer

An event is any observable occurrence; an incident is an event with negative security impact

Answer

An event is any observable system activity, while an incident is specifically an event that threatens the confidentiality, integrity, or availability of information.

Question 3

A security team is performing root cause analysis after a ransomware attack. Which artifact would MOST help identify the initial infection vector?

Accepted Answer

Email server logs and web proxy logs

Answer

Email logs and web proxy logs reveal what was received and browsed before the infection, helping identify the phishing email or malicious download that started the attack.

Question 4

Which technique involves using decoy systems to detect and analyze attacker behavior?

Accepted Answer

Honeypot deployment

Answer

Honeypots are intentionally vulnerable decoy systems that lure attackers, allowing defenders to observe their tactics, techniques, and procedures.

Question 5

During eradication, a responder discovers malware persistence via a scheduled task. What is the BEST next step?

Accepted Answer

Delete the scheduled task and scan for additional persistence mechanisms

Answer

Removing the malicious scheduled task and then scanning for other persistence methods ensures the threat is fully eradicated before recovery begins.

(SY0-601) CompTIA Security+ IT Certification Practice Test

(SY0-601) CompTIA Security+ IT Certification Practice Test

SY0-601 Operations & Incident Response 4