41. Detecting AS-REP roasting
Which pattern points to AS-REP roasting in domain controller logs?
- A.Event 4768 TGT requests with Pre-Authentication Type 0 for accounts that have "Do not require Kerberos preauthentication" set
- B.Event 4769 requests for the krbtgt service
- C.Event 4624 logon type 2 on a workstation
- D.Event 4740 account lockouts across many users
Show answer
Answer: A. Event 4768 TGT requests with Pre-Authentication Type 0 for accounts that have "Do not require Kerberos preauthentication" set
Accounts without Kerberos pre-authentication return encrypted data that attackers can crack offline without knowing the password first. Event 4768 with pre-auth type 0, often with RC4 encryption (0x17), shows such a request. Remove the DONT_REQ_PREAUTH flag wherever possible and give remaining accounts long random passwords.
42. Promoting a rule from test to stable
A Sigma rule in your repo has `status: experimental`. What should usually happen before it is changed to `status: stable` and allowed to page on-call?
- A.It is converted to at least three SIEM languages
- B.It runs in production long enough to measure noise and is tuned
- C.Its level is raised to critical so it gets attention
- D.Its author field is changed to the SOC manager
Show answer
Answer: B. It runs in production long enough to measure noise and is tuned
Sigma statuses describe maturity: experimental and test rules may be noisy or unproven, while stable rules have been run and tuned. A sensible pipeline runs new rules silently or to a low-priority queue, measures volume and precision, adds exclusions, then promotes them. Severity and author have nothing to do with maturity.
43. An AMSI bypass in script logs
A 4104 script block contains `[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')` and `amsiInitFailed`. What is the script doing?
- A.Disabling AMSI in the session so later code is not scanned
- B.Installing the latest Microsoft Defender signatures
- C.Checking whether PowerShell 7 is installed on the host
- D.Encrypting the PSReadLine history file on disk
Show answer
Answer: A. Disabling AMSI in the session so later code is not scanned
Setting the private amsiInitFailed field makes AMSI think it failed to load, so script content is no longer passed to antivirus. This is a classic bypass (T1562.001) that attackers run before loading tools. Real scripts almost never touch AmsiUtils, so this string in Script Block Logging is a high-fidelity alert, though attackers obfuscate it.
44. An attacker adding a Defender exclusion
Why is `Add-MpPreference -ExclusionPath C:\ProgramData\Intel` run from a script a valuable alert even if Defender stays on?
- A.It only changes the time of the next scheduled scan
- B.It sends a copy of the folder to Microsoft for analysis
- C.Files in that path are then not scanned, so tools can be dropped there
- D.It removes all existing Defender detections from the logs
Show answer
Answer: C. Files in that path are then not scanned, so tools can be dropped there
Exclusions make Defender skip a folder, process or extension, which lets attackers stage tools without turning protection off and raising the obvious alert. Defender logs config changes (Event 5007), and the PowerShell command appears in 4104. Exclusions should be set centrally, so local changes are suspicious.
45. Lowering a brute-force threshold
Out of 20 test attacks, a threshold of 10 failures caught 12 with 40 false positives a week. A threshold of 5 caught 18 with 200 false positives. What happens to recall and precision?
- A.Both recall and precision go up
- B.Recall goes from 60% to 90%; precision falls from about 23% to 8%
- C.Recall falls from 90% to 60%; precision rises to 50%
- D.Recall stays at 100%; only precision changes
Show answer
Answer: B. Recall goes from 60% to 90%; precision falls from about 23% to 8%
Recall is 12 ÷ 20 = 60% at threshold 10 and 18 ÷ 20 = 90% at 5. Precision is 12 ÷ 52 ≈ 23% and 18 ÷ 218 ≈ 8%. Lower thresholds usually catch more but bring more noise, so consider enrichment or risk scoring rather than just moving the number.
46. Worst-case time to alert
Logs arrive up to 10 minutes late, so a rule runs every 15 minutes over the window from 25 to 10 minutes ago. In the worst case, how long after an event happens is the alert raised?
- A.About 25 minutes
- B.About 10 minutes
- C.About 15 minutes
- D.About 40 minutes
Show answer
Answer: A. About 25 minutes
An event just after the end of one window (10 minutes before that run) is checked at the next run, 15 minutes later, so it is 10 + 15 = 25 minutes old by then. Detection latency is a design choice: shorter schedules or streaming rules reduce it for critical cases.
47. A host with thousands of NXDOMAINs
One host makes 3,000 DNS lookups an hour for random-looking domains like qx7vtk2m.info, almost all returning NXDOMAIN. What is the most likely cause?
- A.A browser preloading the next search results
- B.A local DNS server that is badly out of date
- C.Malware using a DGA to look for its C2 server
- D.An NTP client syncing its clock with servers
Show answer
Answer: C. Malware using a DGA to look for its C2 server
Domain generation algorithms make many pseudo-random names and try them until one the attacker registered resolves. That leaves many failed lookups for high-entropy names. Detect with NXDOMAIN rates per host plus name entropy, then find the process making the queries.
48. Spraying slower than the lockout
AD locks an account after 5 bad passwords, and the bad-password counter resets 30 minutes after the last failure. An attacker tries one password against every user every 40 minutes. Over 24 hours, how many guesses per user and how many lockouts?
- A.5 guesses per user, then every account is locked
- B.36 guesses per user and no lockouts at all
- C.48 guesses per user and about 9 lockouts each
- D.24 guesses per user and one lockout each
Show answer
Answer: B. 36 guesses per user and no lockouts at all
24 × 60 / 40 = 36 attempts per user. Each attempt comes after the 30-minute reset, so the counter never goes above 1 and nobody is locked out. Lockout alone does not stop slow spraying; you need banned-password checks, MFA, and detection of one source failing against many accounts.
49. Attacker uses the same email vendor
Your SPF has include:bigesp.example. An attacker opens his own account on that same email service and sends mail with Return-Path on your domain. SPF passes. What still stops him under DMARC p=reject?
- A.DMARC always blocks mail sent through vendors
- B.SPF alignment fails because the IP is shared
- C.Nothing, unless the vendor checks domain ownership
- D.The DKIM check fails for all shared vendors
Show answer
Answer: C. Nothing, unless the vendor checks domain ownership
If the vendor lets any customer use your domain as the envelope sender, the IP is in your SPF and the domain aligns, so DMARC passes. That is why broad shared includes are risky. Prefer vendors that verify domain ownership, and use DKIM with your own keys or a dedicated subdomain per vendor.
50. Caller asks helpdesk to reset MFA
A caller claiming to be a senior engineer says he lost his phone and asks the helpdesk to reset his MFA. He knows his employee ID and manager's name. What is the strongest verification?
- A.Accept the employee ID and manager name as proof
- B.Verify through a manager callback or ID check on video
- C.Ask him to email the same request from his work account
- D.Reset MFA but limit the account for one hour
Show answer
Answer: B. Verify through a manager callback or ID check on video
Groups such as Scattered Spider have breached large firms by calling helpdesks with details found on LinkedIn or in leaks. Facts like ID and manager are not secrets. Use out-of-band checks such as a callback via the manager or a live ID check before resetting MFA.
51. OTPs going to the attacker
A customer's phone suddenly loses signal, and within an hour OTP-protected transfers leave her account. What is the most likely attack?
- A.A DKIM replay of her bank's transaction alert emails
- B.A watering hole on her bank's website
- C.A phishing simulation by her employer
- D.SIM swap, moving her number to the attacker's SIM
Show answer
Answer: D. SIM swap, moving her number to the attacker's SIM
In a SIM swap, a fraudster convinces or bribes the mobile operator to move the number to a new SIM, so SMS OTPs go to the attacker. Sudden loss of service is a key warning sign. App-based or phishing-resistant authentication avoids relying on the phone number.
52. RSA private key with small numbers
In a toy RSA example, p = 5, q = 11 and the public exponent e = 3. What is the private exponent d?
- A.7
- B.27
- C.13
- D.33
Show answer
Answer: B. 27
n = 55 and φ(n) = (5−1)(11−1) = 40. d is the inverse of e mod φ(n): 3 × 27 = 81 = 2 × 40 + 1, so d = 27. Real RSA uses primes hundreds of digits long, which is what makes factoring n impractical.
53. Salts leaked with the hashes
An attacker steals a table of bcrypt hashes along with their salts. What protection does the salt still give?
- A.None, because salts only work while they stay secret
- B.Each password must be attacked one by one, not in bulk
- C.The hashes can no longer be cracked at all
- D.The attacker must also steal the secret bcrypt key
Show answer
Answer: B. Each password must be attacked one by one, not in bulk
Salts are not secret. Their job is to make each hash unique, so precomputed rainbow tables do not work and the same password gives different hashes for different users. The attacker must guess per user, and bcrypt's cost factor makes each guess slow.
54. The join that lost rows
A user has 3 sign-in rows and 2 mailbox rows. This join returns fewer rows than you expected. Why?
SigninLogs
| join (OfficeActivity) on $left.UserPrincipalName == $right.UserId
- A.join cannot match columns with different names
- B.OfficeActivity rows are always dropped by join
- C.The time range is ignored by the right side
- D.The default kind, innerunique, dedups the left side keys
Show answer
Answer: D. The default kind, innerunique, dedups the left side keys
With no kind given, KQL uses innerunique: it keeps only one left row per key before matching. So the 3 sign-ins become 1, giving 2 rows instead of 6. Write kind=inner when you want every combination.
55. Hours with no events vanish
A chart of failed logons per hour made with summarize count() by bin(TimeGenerated, 1h) skips hours that had no failures, which breaks your anomaly function. What fixes it?
- A.make-series, which fills empty bins with a default of 0
- B.Change bin to 1d so that every bucket has some data
- C.Add | sort by TimeGenerated asc at the end of the query
- D.Use take 24 at the end to force exactly 24 rows
Show answer
Answer: A. make-series, which fills empty bins with a default of 0
summarize only returns bins that contain at least one row, so quiet hours are missing. make-series builds an evenly spaced series and fills gaps with a default, usually 0. Functions such as series_decompose_anomalies() need that complete series.
56. Why dcount differs from the exact count
dcount(DeviceId) reports 10,042 devices but your asset system says exactly 10,000 onboarded. What is the likely reason?
- A.dcount counts every row, including duplicates
- B.dcount is an estimate with a small error margin
- C.dcount includes devices from other tenants
- D.dcount rounds up to the nearest hundred
Show answer
Answer: B. dcount is an estimate with a small error margin
dcount uses a HyperLogLog-style estimate that is fast on huge data but can be off by a small percentage. A 0.4% gap fits that. For exact counts on smaller sets, use count_distinct() or summarize by the key and count the rows.
57. Pay-as-you-go or commitment tier?
With these example prices, you ingest 120 GB a day. How much per day does the 100 GB tier save compared with pay-as-you-go?
Pay-as-you-go: $5.00 per GB
100 GB/day tier: $300 per day
Overage on tier: $3.00 per GB above 100 GB
- A.$60
- B.$120
- C.$240
- D.$300
Show answer
Answer: C. $240
Pay-as-you-go costs 120 × $5 = $600. The tier costs $300 plus 20 GB × $3 = $60, so $360. The saving is $600 − $360 = $240 a day. Always check current list prices; these numbers are only for practice.
58. A rule that went quiet
A firewall rule that fired weekly has been silent for a month. You learn the vendor updated its log format and the parser now puts the source IP in a new field. What is the real problem?
- A.A false negative: the rule reads a field that is now empty
- B.A false positive: the rule is firing on benign traffic
- C.Normal behaviour: attackers have stopped targeting you
- D.A licence issue: the connector exceeded its quota
Show answer
Answer: A. A false negative: the rule reads a field that is now empty
When parsing changes, rules that depend on a renamed field quietly stop matching. Silence does not mean safety. Monitor rule health, track expected alert volumes, and test rules against sample data after any parser or connector change.
59. Comparing a row with the previous one
You want the time gap between each user's consecutive sign-ins. Which approach works in KQL?
- A.Sort by user and time, then use prev() to read the last row
- B.Use dcount() on the TimeGenerated column
- C.Use take 2 for each user and subtract
- D.Use make_set() and subtract the set from itself
Show answer
Answer: A. Sort by user and time, then use prev() to read the last row
Window functions such as prev() and next() need a serialized row order, which sort provides. Compare prev(UserPrincipalName) with the current user, then subtract prev(TimeGenerated) to get each gap. This is a common base for beacon and session analysis.
60. Firewall logs missing at peak hours
During busy hours, counts of firewall logs in the SIEM drop sharply, though traffic rises. Logs are sent as UDP syslog straight to the SIEM. What is the most likely cause and fix?
- A.UDP drops packets under load; use TCP or TLS via a buffering collector
- B.The firewall stops logging at peak by design; nothing can be done
- C.The SIEM deletes duplicate logs at peak; turn off dedup
- D.Syslog needs a weekly restart to clear memory
Show answer
Answer: A. UDP drops packets under load; use TCP or TLS via a buffering collector
UDP has no delivery guarantee, so when buffers fill, messages are silently lost. Sending over TCP or TLS to a local collector that queues data, such as a syslog relay or forwarder, absorbs bursts. Also monitor expected volumes per source to spot gaps.
