Question 20
An immediate process decision is needed for the following concern: A payroll server shows a new administrator login immediately before confidential reports appeared on an unknown share. Before long-term corrections, which authorized response action fits the current need?
- Correlate privileged sign-in records with file-share audit events
- Revalidate privileged grants and remove unauthorized share access
- Route the event to documented triage instead of declaring a breach
- Suspend the suspect privileged session while preserving its session identifiers
Explanation
Correct Answer
D:Revoking the active access path limits further disclosure without discarding the account activity already logged; the immediate coordination decision concerns whether a security event involved unauthorized access; it keeps the response process under explicit control.
Incorrect Answers
A:The joined timeline can connect an identity, access to protected files, and the suspicious destination; the case needs immediate response coordination addressing whether a security event involved unauthorized access; investigation alone does not control current conditions.
B:Eliminating the access path addresses the control failure before sensitive workflows resume; when judging whether a security event involved unauthorized access, corrective follow-through follows initial protection; this is instead procedural correction.
C:Classification prevents unnecessary destructive response while retaining evidence of the observed activity; the other incident centers on whether an alert is a confirmed incident, not this immediate response coordination question about whether a security event involved unauthorized access.
Question 21
An incident-process audit asks for a defensible finding about this case: An analyst wants to notify affected customers immediately after a suspected personal-data leak without consulting legal counsel. Which assessment task resolves the central procedural uncertainty?
- Embed jurisdiction-specific privacy triggers in the response notification matrix
- Establish data categories, affected jurisdictions, certainty and exposure timeline
- Map affected data subjects, controllers, processors and relevant jurisdictions
- Escalate to privacy and legal owners while preserving factual incident details
Explanation
Correct Answer
B:Applicable notice rules depend on governing law and the actual nature of the breach; the review establishes whether notification requirements are factually triggered so that responsibility and next decisions rest on a recorded result.
Incorrect Answers
A:Preplanned legal routing minimizes missed deadlines and unauthorized statements; the case needs process validation addressing whether notification requirements are factually triggered; prevention is not incident verification.
C:Obligations can differ by role, event, and applicable law; the other incident centers on which legal requirements govern notification timing, not this process validation question about whether notification requirements are factually triggered.
D:Authorized review avoids an inaccurate or prematurely broad external disclosure; the requirement concerns whether notification requirements are factually triggered, so immediate protection does not substantiate findings.
Question 22
A procedural case requires a near-term protective assignment: Night-shift responders repeatedly miss handoffs for unresolved lateral-movement cases. Before long-term corrections, which authorized response action fits the current need?
- Create an ordered outstanding-actions list with deadlines and evidence links
- Assign a single incident commander and freeze contradictory changes
- Use a formal shift handoff with a current incident commander
- Compare shift-change tickets against active incident action logs
Explanation
Correct Answer
C:Explicit transfer retains command responsibility while the investigation continues; the immediate coordination decision concerns the missing continuity of incident response; it keeps the response process under explicit control.
Incorrect Answers
A:A verified handoff enables the incoming team to act without recreating the timeline; the case needs immediate response coordination addressing the missing continuity of incident response; corrective follow-through follows initial protection.
B:Central coordination prevents simultaneous actions from damaging the investigation; it is meant to address how incident ownership and assignments broke down, not immediate response coordination for the missing continuity of incident response.
D:Unassigned tasks and incomplete status fields show where ownership information was lost; the requirement concerns the missing continuity of incident response, so investigation alone does not control current conditions.
Question 23
A case commander must regain control of an open handling problem: A response plan cites NIST SP 800-61 Revision 2 as the latest guidance in a 2026 audit. Which first controlled step protects the handling process from further disruption?
- Check the publication revision and supersession notice in NIST CSRC
- Use a separate validated forensic procedure for evidence handling
- Flag the reference for governance correction without abandoning active response procedures
- Update the plan's references and map its workflow to CSF 2.0 functions
Explanation
Correct Answer
C:A citation update must not interrupt evidence preservation during a live incident; this protective or assignment decision directly addresses whether cited incident-response guidance is current while response governance is still active.
Incorrect Answers
A:NIST finalized Revision 3 in April 2025, replacing the 2012 guide; when judging whether cited incident-response guidance is current, investigation alone does not control current conditions; this is instead process validation.
B:Specific acquisition methods are still needed alongside strategic cybersecurity outcomes; the relevant condition for that step is what CSF 2.0 actually organizes, which is not shown for whether cited incident-response guidance is current.
D:Revision 3 is a CSF 2.0 community profile rather than a mere renumbering of the old phase list; the goal is immediate response coordination for whether cited incident-response guidance is current. Corrective follow-through follows initial protection.
Question 24
An immediate process decision is needed for the following concern: An incident spans EU customer records and an offshore vendor, but the runbook assumes one universal disclosure deadline. What near-term response-governance action should be taken while the issue is open?
- Use legal-approved minimum-necessary disclosure and secure transfer
- Engage the designated privacy lead for jurisdiction-specific deadlines
- Map affected data subjects, controllers, processors and relevant jurisdictions
- Record the assessed obligations and evidence behind each deadline
- Maintain a reviewed jurisdiction-and-contract notification register
- Escalate to privacy and legal owners while preserving factual incident details
Explanation
Correct Answer
B:Correct routing prevents imposing a generic timeline on every legal regime; the case needs an authorized near-term step for which legal requirements govern notification timing, with longer-term playbook changes handled separately.
Incorrect Answers
A:Controlled release balances investigation needs with confidentiality obligations; the activity targets what authorization governs external evidence sharing; immediate response coordination here concerns which legal requirements govern notification timing.
C:Obligations can differ by role, event, and applicable law; the goal is immediate response coordination for which legal requirements govern notification timing. Investigation alone does not control current conditions.
D:A documented analysis supports consistent and timely communication; corrective follow-through follows initial protection in the decision about which legal requirements govern notification timing.
E:Legal and vendor requirements can be checked rapidly during an incident; the case needs immediate response coordination addressing which legal requirements govern notification timing; prevention cannot replace immediate action.
F:Authorized review avoids an inaccurate or prematurely broad external disclosure; the activity targets whether notification requirements are factually triggered; immediate response coordination here concerns which legal requirements govern notification timing.
Question 25
Response staff seek a controlled first step after this problem: An automation service account can modify security policies across every tenant despite serving one investigation workspace. Which immediate assignment, safeguard or coordination decision is justified?
- Rotate its secret and reissue role grants after approval testing
- Enumerate the integration identity's effective permissions and target scopes
- Disable automatic termination until approved forensic capture succeeds
- Restrict the credential to approved incident actions and affected resources
Explanation
Correct Answer
D:Least-privilege scoping shrinks the possible blast radius of a compromised integration; the immediate coordination decision concerns whether orchestration violates least privilege; it keeps the response process under explicit control.
Incorrect Answers
A:Credential replacement and entitlement review restore trust in the integration; the requirement concerns whether orchestration violates least privilege, so corrective follow-through follows initial protection.
B:Excessive cross-tenant grants increase the impact of automation mistakes; the goal is immediate response coordination for whether orchestration violates least privilege. Investigation alone does not control current conditions.
C:A safety gate protects evidence while still allowing non-destructive isolation; this serves whether destructive automation has preservation safeguards, whereas the requested result is immediate response coordination involving whether orchestration violates least privilege.
Question 26
A case closure review must correct this incident-management failure: A SOC manager assesses responder performance only by how quickly tickets are closed. Choose THREE actions that separately diagnose the incident-handling deficiency, stabilize the response process and correct it before closure. (Choose THREE.)
- Sample fast-closed cases for evidence completeness and recurrence
- Use containment time, detection lag, evidence quality and recurrence together
- Publish severity definitions with worked examples and training
- Introduce quality checks and track repeat compromise after closure
- Suspend automatic closure incentives during active high-impact investigations
- Require a named owner and change log for every high-severity incident
Explanation
Correct Answers
A:Closure time alone cannot establish whether the attack was actually resolved; within the combined response for whether speed metrics reward poor incident decisions, this supplies process validation: that check tests whether speed metrics reward poor incident decisions without assuming that a policy citation alone proves operational compliance.
D:Outcome measures reveal cases prematurely marked resolved; within the combined response for whether speed metrics reward poor incident decisions, this supplies procedural correction: the correction restores accountability or sequence for whether speed metrics reward poor incident decisions before case sign-off.
E:The incident outcome should drive decisions rather than a throughput target; within the combined response for whether speed metrics reward poor incident decisions, this supplies immediate response coordination: the case needs an authorized near-term step for whether speed metrics reward poor incident decisions, with longer-term playbook changes handled separately.
Incorrect Answers
B:Balanced metrics discourage speed at the expense of correctness; for whether speed metrics reward poor incident decisions, future hardening is not current-state recovery; procedural correction remains necessary.
C:Common interpretation reduces repeated classification disputes; the activity targets how to normalize severity across organizational units; procedural correction here concerns whether speed metrics reward poor incident decisions.
F:Formal accountability prevents duplicated actions and untraceable decisions; the relevant condition for that step is how incident ownership and assignments broke down, which is not shown for whether speed metrics reward poor incident decisions.
Question 27
The owner is reconciling responder actions with the approved plan after: A responder removes one malicious executable but leaves its service configuration and remote credentials active. Which follow-up would repair the reported response-management failure?
- Disable malicious services and revoke affected secrets during controlled containment
- Track root-cause remediation as a required closure dependency
- Remove persistence, rotate compromised credentials and verify clean scanning
- Remove persistence and validate the host before controlled reintegration
Explanation
Correct Answer
C:Complete eradication addresses both malware artifacts and associated identity compromise; the correction restores accountability or sequence for whether eradication removed the attack's persistence before case sign-off.
Incorrect Answers
A:Blocking execution and access paths reduces the chance of immediate re-entry; for whether eradication removed the attack's persistence, temporary protection does not complete correction; procedural correction remains necessary.
B:Technical closure should include all enabling weaknesses, not just file removal; the requirement concerns whether eradication removed the attack's persistence, so future hardening is not current-state recovery.
D:Containment alone does not remove the executable or its scheduled startup path; the other incident centers on which action limits ongoing exfiltration, not this procedural correction question about whether eradication removed the attack's persistence.
Question 28
An immediate process decision is needed for the following concern: A triage analyst has only an IP address from an old NAT gateway log and assigns the incident to the wrong user. What near-term response-governance action should be taken while the issue is open?
- Open a central incident record and assign an authorized handler
- Correct the case attribution and document uncertain mappings
- Correlate source port, timestamp, NAT translation and identity session records
- Pause individual account sanctions until attribution is independently validated
Explanation
Correct Answer
D:Evidence-based escalation avoids disrupting an innocent user's access; the case needs an authorized near-term step for how to attribute network activity reliably, with longer-term playbook changes handled separately.
Incorrect Answers
A:A single case record makes containment and escalation attributable; this serves how incident recording supports traceability, whereas the requested result is immediate response coordination involving how to attribute network activity reliably.
B:Traceable assumptions keep an investigation from building on false identity claims; the requirement concerns how to attribute network activity reliably, so corrective follow-through follows initial protection.
C:Shared addresses cannot identify a unique user without translation and timing context; the goal is immediate response coordination for how to attribute network activity reliably. Investigation alone does not control current conditions.
Question 29
An incident-process audit asks for a defensible finding about this case: A SOAR workflow deletes suspect cloud instances as soon as a high-severity alert appears, destroying short-lived evidence. Which assessment task resolves the central procedural uncertainty?
- Review the playbook trigger thresholds and isolation execution logs
- Use preproduction simulation and privileged-action guardrails for playbooks
- Compare the automation runbook with required evidence snapshot checkpoints
- Rebuild the workflow with snapshots, approvals and tested rollback
- Disable automatic termination until approved forensic capture succeeds
Explanation
Correct Answer
C:A missing acquisition step explains why terminated resources lost relevant artifacts; the review establishes whether destructive automation has preservation safeguards so that responsibility and next decisions rest on a recorded result.
Incorrect Answers
A:Comparing alert confidence to actions shows whether automation exceeded agreed risk tolerance; that method could help with the risk of excessive automated containment; the process validation decision here involves whether destructive automation has preservation safeguards.
B:Validation limits damage from poorly scoped automated response; when judging whether destructive automation has preservation safeguards, prevention is not incident verification; this is instead readiness improvement.
D:Sequenced response preserves investigation value before cleanup; the requirement concerns whether destructive automation has preservation safeguards, so recovery is not factual verification.
E:A safety gate protects evidence while still allowing non-destructive isolation; the goal is process validation for whether destructive automation has preservation safeguards. Immediate protection does not substantiate findings.
Question 30
A case closure review must correct this incident-management failure: The SOC calls every ATT&CK technique observed in logs a separate incident and loses the attack narrative. What is the appropriate procedural remediation for the gap described?
- Close documented gaps with exercised procedures and retained results
- Group related detections into a single managed incident when supported by evidence
- Build a cohesive intrusion timeline with mapped ATT&CK techniques
- Train analysts to separate analytic technique tags from incident identifiers
Explanation
Correct Answer
C:A technique map helps explain behavior without replacing incident evidence; the correction restores accountability or sequence for how technique mapping relates to incident grouping before case sign-off.
Incorrect Answers
A:Corrective evidence supports defensible claims about operational readiness; that method could help with the gap between guidance adoption and operational evidence; the procedural correction decision here involves how technique mapping relates to incident grouping.
B:Correlation improves coordinated containment and avoids fragmented response; the case needs procedural correction addressing how technique mapping relates to incident grouping; temporary protection does not complete correction.
D:Consistent taxonomy prevents misleading case counts; for how technique mapping relates to incident grouping, future hardening is not current-state recovery; procedural correction remains necessary.
