Security Operations

Monitoring, threat hunting, incident response, vulnerability analysis, and digital forensics for enterprise security operations.

5 minutes 5 Questions

Security Operations (SecOps) in CompTIA CASP+ represents the continuous processes and activities that organizations implement to protect their information systems and data from threats. It encompasses the integration of security practices into daily operational activities across an enterprise. Sec…

Concepts covered
Event Parsing, Retention, and Log ManagementVulnerability and Attack Surface AnalysisExternal Intelligence (OSINT, Dark Web, ISACs)Detection Rule Languages (Sigma, YARA, Snort)Malware Analysis and SandboxingRoot Cause Analysis and Post-Incident ReviewInternal Intelligence (Honeypots, UBA)SIEM Configuration and Event ManagementAggregate Analysis (Correlation, Prioritization)Behavior Baselines and Anomaly DetectionFalse Positive and False Negative ManagementCommon Vulnerabilities (Injection, XSS, Misconfig)Defense-in-Depth and Mitigation StrategiesThreat Hunting Concepts and TechniquesThreat Intelligence Platforms and IoC SharingIncident Response Planning and LifecycleReverse Engineering and Code StylometryData Recovery and Evidence HandlingMetadata Analysis and Artifact Examination
Test mode:
Start practice test

SecurityX - Security Operations Example Questions

Test your knowledge of Security Operations

Question 1

An organization deploys honeytokens as fake SSH private keys across developer workstations and monitors them via UBA. Over two weeks, UBA flags three events: (1) a developer copies a honeytoken key to a USB drive during authorized backup procedures, (2) a service account attempts SSH authentication using a honeytoken key from an unexpected subnet, and (3) a contractor's account queries DNS for a honeytoken hostname embedded in a decoy configuration file. The SOC must determine which combination of events most reliably indicates adversarial activity versus operational noise. Which assessment is most accurate?

Correct Answer: Events 2 and 3 together represent the strongest adversarial indicators because they involve credential use and reconnaissance from contexts where legitimate workflows would not interact with decoy artifacts

Events 2 and 3 are the strongest adversarial indicators because a service account authenticating with a fake SSH key from an unexpected subnet and a contractor resolving a honeytoken hostname embedded in a decoy file both represent interactions that no legitimate workflow would produce, indicating credential abuse and active reconnaissance respectively.

Treating all three equally ignores that Event 1 occurred during authorized backup procedures, making it operational noise rather than confirmed malicious intent. Pairing Events 1 and 2 incorrectly elevates the authorized backup activity to an adversarial indicator. Claiming Event 3 alone is most reliable undervalues the strong signal from unauthorized credential use in Event 2.

Key concept tested: distinguishing true positive honeytoken triggers from false positives caused by legitimate operational context using behavioral analysis.

Question 2

What does log parsing refer to in SIEM operations?

Correct Answer: Breaking raw log data into structured fields for analysis

Log parsing in SIEM operations refers to the process of taking raw, unstructured log data and breaking it into structured, meaningful fields such as timestamps, source IPs, event types, and usernames so that the data can be efficiently searched, correlated, and analyzed.

Encrypting log data relates to data protection, not parsing. Compressing log data pertains to storage optimization and retention management, not analysis preparation. Forwarding log data describes log shipping or replication, which is a transport function rather than a parsing function.

The key concept tested is understanding SIEM data normalization and the role of log parsing in enabling effective security event analysis.

Question 3

A team is setting up a threat intelligence platform and needs to understand how IoCs are categorized. An analyst receives a STIX bundle containing an indicator with the pattern [file:hashes.'MD5' = 'd41d8cd98f00b204e9800998ecf8427e']. What type of observable does this STIX pattern represent?

Correct Answer: A file hash indicator used to identify a specific malicious file by its MD5 checksum value

The STIX pattern [file:hashes.'MD5' = 'd41d8cd98f00b204e9800998ecf8427e'] explicitly references a file object's MD5 hash property, making it a file hash indicator used to identify a specific malicious file by matching its MD5 checksum value against known threats.

The network traffic answer is wrong because the pattern clearly references a file object, not network traffic. The malware family classification answer is wrong because an MD5 hash identifies a specific file, not a malware family. The digital certificate answer is wrong because MD5 file hashes are not digital certificates used for authenticity verification.

Key concept tested: understanding STIX Cyber Observable patterns and Indicator of Compromise categorization in threat intelligence sharing.

More Security Operations questions
335 questions (total)
Practice 100 questions
One session at a time, always new questions