SOC

Evidence should be

Which language is used to query data in Splunk?

In phishing emails, attackers often use

Scenario: User clicked a phishing link and entered credentials.What is the best first response?

What is the primary function of a Security Operations Center (SOC)?

Scenario: Several users clicked a phishing email. What control best prevents this?

What character acts as a wildcard in Splunk?

Scenario: Ransomware was reported on 5 machines in finance.What is the best first response?

Which of the following data types can Autopsy analyze?

Which tool from NirSoft is used to view historical USB device connection information?

What is the final phase of incident response?

Which SOC role is primarily responsible for triaging alerts and performing initial analysis?

Scenario: Endpoint connects to IP flagged on VirusTotal. What does this indicate?

Autopsy is built on top of which forensic framework?

Scenario: Repeated logins from a terminated employee’s account. Likely cause?

Which tool captures memory for forensics?

What is Splunk primarily used for?

SIEM’s fundamental capabilities include:

In a malware infection scenario, what should be done first?

Which Splunk component is responsible for indexing data?

Which protocol is used to send emails?

What is the default port used by Splunk Web?

Scenario: Email with “reset password” link sent to all staff. What’s the tactic?

Scenario: 20 login attempts in 10 seconds on a server. What does this indicate?

Which of the following is NOT a type of SOC model?

Scenario: Employees report email asking for urgent login. It's from '[email protected]'. What is this?