Question 40
A case commander must regain control of an open handling problem: An alert involving payment-card data was categorized low because only one host was affected. The manager needs a check that verifies the issue AND an immediate controlled assignment or safeguard. Which TWO case-specific steps fulfill those distinct roles? (Choose TWO.)
- Review affected data classification together with host criticality and exposure
- Escalate under the high-impact data-exposure criteria
- Reclassify affected cases using the agreed business-impact scale
- Include data sensitivity and regulatory triggers in triage scoring
- Reassess scope and record the corrected severity and response deadlines
Explanation
Correct Answers
A:Business sensitivity can outweigh the number of visibly impacted machines; within the combined response for whether incident priority reflects business impact, this supplies process validation: this provides an auditable basis for the disputed finding: whether incident priority reflects business impact.
B:Severity-based routing brings in the correct legal and technical decision makers early; within the combined response for whether incident priority reflects business impact, this supplies immediate response coordination: this protective or assignment decision directly addresses whether incident priority reflects business impact while response governance is still active.
Incorrect Answers
C:Consistent severity supports defensible reporting across teams; the relevant condition for that step is how to normalize severity across organizational units, which is not shown for whether incident priority reflects business impact.
D:Impact criteria prevent host-count-only severity mistakes; prevention cannot replace immediate action in the decision about whether incident priority reflects business impact.
E:An impact-driven case update fixes the prioritization error before closure; the case needs immediate response coordination addressing whether incident priority reflects business impact; corrective follow-through follows initial protection.
Question 41
An immediate process decision is needed for the following concern: A SOAR workflow deletes suspect cloud instances as soon as a high-severity alert appears, destroying short-lived evidence. Select TWO actions covering procedural assessment and an authorized near-term response—not full process redesign. (Choose TWO.)
- Use preproduction simulation and privileged-action guardrails for playbooks
- Disable automatic termination until approved forensic capture succeeds
- Review SOAR identities and permissions whenever playbooks change
- Compare the automation runbook with required evidence snapshot checkpoints
- Rebuild the workflow with snapshots, approvals and tested rollback
Explanation
Correct Answers
B:A safety gate protects evidence while still allowing non-destructive isolation; within the combined response for whether destructive automation has preservation safeguards, this supplies immediate response coordination: the immediate coordination decision concerns whether destructive automation has preservation safeguards; it keeps the response process under explicit control.
D:A missing acquisition step explains why terminated resources lost relevant artifacts; within the combined response for whether destructive automation has preservation safeguards, this supplies process validation: the review establishes whether destructive automation has preservation safeguards so that responsibility and next decisions rest on a recorded result.
Incorrect Answers
A:Validation limits damage from poorly scoped automated response; when judging whether destructive automation has preservation safeguards, prevention cannot replace immediate action; this is instead readiness improvement.
C:Continuous access governance prevents authorization drift; the activity targets whether orchestration violates least privilege; immediate response coordination here concerns whether destructive automation has preservation safeguards.
E:Sequenced response preserves investigation value before cleanup; corrective follow-through follows initial protection in the decision about whether destructive automation has preservation safeguards.
Question 42
An incident-process audit asks for a defensible finding about this case: A ransomware alert has no assigned communication owner, and public relations releases contradictory information. Which assessment task resolves the central procedural uncertainty?
- Correlate egress flows with process connections to confirm active command traffic
- Centralize stakeholder communication under the incident commander and approved spokesperson
- Preassign spokespersons, approval gates and communication templates
- Compare incident command approvals with each outbound statement
Explanation
Correct Answer
D:Missing authorization reveals why accounts of the event diverged; the review establishes what made external incident messaging inconsistent so that responsibility and next decisions rest on a recorded result.
Incorrect Answers
A:Both data sources link the suspicious endpoint to ongoing outbound communication; the other incident centers on which action limits ongoing exfiltration, not this process validation question about what made external incident messaging inconsistent.
B:Single-source approval reduces speculation and contradictory disclosures; when judging what made external incident messaging inconsistent, immediate protection does not substantiate findings; this is instead immediate response coordination.
C:A rehearsal-tested plan makes crisis messages consistent; for what made external incident messaging inconsistent, prevention is not incident verification; process validation remains necessary.
Question 43
A case closure review must correct this incident-management failure: An automation service account can modify security policies across every tenant despite serving one investigation workspace. What documented correction must be verified before the procedural case closes?
- Rotate its secret and reissue role grants after approval testing
- Test revised triggers against representative benign and malicious alerts
- Review SOAR identities and permissions whenever playbooks change
- Restrict the credential to approved incident actions and affected resources
Explanation
Correct Answer
A:Credential replacement and entitlement review restore trust in the integration; procedural closure should resolve whether orchestration violates least privilege in the incident record, not just remove a visible symptom.
Incorrect Answers
B:Simulation checks that the updated workflow reduces false containment; it is meant to address the risk of excessive automated containment, not procedural correction for whether orchestration violates least privilege.
C:Continuous access governance prevents authorization drift; future hardening is not current-state recovery in the decision about whether orchestration violates least privilege.
D:Least-privilege scoping shrinks the possible blast radius of a compromised integration; the case needs procedural correction addressing whether orchestration violates least privilege; temporary protection does not complete correction.
Question 44
The response coordinator tests a weakness described in these records: A vendor asks a responder to forward raw incident logs containing personal identifiers to an unrelated external consultant. Which assessment task resolves the central procedural uncertainty?
- Determine data sensitivity, contractual scope and approved recipients
- Establish data minimization and third-party sharing controls in playbooks
- Confirm the lawful request, evidence scope and authorized custodian
- Use legal-approved minimum-necessary disclosure and secure transfer
- Log recipient, purpose, content and secure deletion or retention terms
Explanation
Correct Answer
A:Evidence sharing can itself create unnecessary exposure when recipient authority is unverified; the review establishes what authorization governs external evidence sharing so that responsibility and next decisions rest on a recorded result.
Incorrect Answers
B:Preauthorized paths prevent ad hoc disclosure during emergencies; when judging what authorization governs external evidence sharing, prevention is not incident verification; this is instead readiness improvement.
C:The legal process and collection requirements determine what must be retained; the other incident centers on how to reconcile evidence preservation with operational recovery, not this process validation question about what authorization governs external evidence sharing.
D:Controlled release balances investigation needs with confidentiality obligations; the requirement concerns what authorization governs external evidence sharing, so immediate protection does not substantiate findings.
E:A complete disclosure record supports accountability after the incident; the goal is process validation for what authorization governs external evidence sharing. Recovery is not factual verification.
Question 45
The team wants a measurable hardening change following this situation: An orchestration playbook automatically isolates every host with a single low-confidence malware alert. What improvement best addresses the root weakness in a future incident?
- Use risk-based automation tiers and rollback controls
- Use tested SOAR integrations with access-scoped service identities
- Review the playbook trigger thresholds and isolation execution logs
- Test revised triggers against representative benign and malicious alerts
Explanation
Correct Answer
A:Different thresholds for enrichment and disruptive action make orchestration safer; it makes the lesson about the risk of excessive automated containment part of normal operations.
Incorrect Answers
B:Controlled integrations reduce transcription errors without granting unnecessary privileges; this serves where manual coordination delays indicator response, whereas the requested result is readiness improvement involving the risk of excessive automated containment.
C:Comparing alert confidence to actions shows whether automation exceeded agreed risk tolerance; for the risk of excessive automated containment, an investigation is not recurrence prevention; readiness improvement remains necessary.
D:Simulation checks that the updated workflow reduces false containment; the requirement concerns the risk of excessive automated containment, so case recovery is not future-risk control.
Question 46
Response staff seek a controlled first step after this problem: An automated credential-revocation workflow succeeded in the identity provider but the ticket still reads pending. The manager needs a check that verifies the issue AND an immediate controlled assignment or safeguard. Which TWO case-specific steps fulfill those distinct roles? (Choose TWO.)
- Reconcile identity audit events with the playbook's callback and error logs
- Use risk-based automation tiers and rollback controls
- Monitor action completion receipts rather than workflow invocation alone
- Manually verify the session is invalid before triggering another revocation
- Repair the workflow callback and re-run an idempotent status check
Explanation
Correct Answers
A:A missing acknowledgement can leave the case stale despite an executed revocation; within the combined response for why orchestration status differs from control state, this supplies process validation: the review establishes why orchestration status differs from control state so that responsibility and next decisions rest on a recorded result.
D:State checking prevents duplicate disruptive steps and allows safe incident progression; within the combined response for why orchestration status differs from control state, this supplies immediate response coordination: the immediate coordination decision concerns why orchestration status differs from control state; it keeps the response process under explicit control.
Incorrect Answers
B:Different thresholds for enrichment and disruptive action make orchestration safer; the other incident centers on the risk of excessive automated containment, not this immediate response coordination question about why orchestration status differs from control state.
C:End-to-end confirmation catches silent integration and acknowledgement failures; the case needs immediate response coordination addressing why orchestration status differs from control state; prevention cannot replace immediate action.
E:Idempotency avoids multiple side effects when a status update is retried; for why orchestration status differs from control state, corrective follow-through follows initial protection; immediate response coordination remains necessary.
Question 47
A control owner is preparing preventive actions after observing: An organization has a CSF 2.0 profile but incorrectly claims it is a forensic evidence acquisition standard. What tested hardening or process measure follows from the lessons learned?
- Examine the profile's Govern, Identify, Protect, Detect, Respond and Recover functions
- Map incident response capabilities to CSF functions and forensic SOPs
- Maintain clear mappings between strategic frameworks and tactical procedures
- Train analysts to separate analytic technique tags from incident identifiers
Explanation
Correct Answer
C:Document clarity prevents responders from expecting nonexistent implementation instructions; its effectiveness can be exercised against the warning conditions associated with what CSF 2.0 actually organizes.
Incorrect Answers
A:These risk-management outcomes do not prescribe bit-for-bit disk imaging procedures; the goal is readiness improvement for what CSF 2.0 actually organizes. An investigation is not recurrence prevention.
B:Complementary guidance avoids treating a framework as a detailed tool runbook; case recovery is not future-risk control in the decision about what CSF 2.0 actually organizes.
D:Consistent taxonomy prevents misleading case counts; it is meant to address how technique mapping relates to incident grouping, not readiness improvement for what CSF 2.0 actually organizes.
Question 48
To prevent the next similar event, analysts review this case: An alert on a production database has high confidence but the scope is unknown and the assigned analyst wants to close it. Which preventive change targets the exact pathway that failed?
- Retain synchronized NAT, DHCP and authentication logs at adequate granularity
- Record the final validated scope, disposition and decision rationale
- Use severity criteria combining confidence, criticality and potential data impact
- Check alert provenance, related events and the database's business criticality
Explanation
Correct Answer
C:Balanced triage avoids dismissing important uncertain alerts; the control owner can test whether this reduces repeat conditions affecting what triage must establish before closure.
Incorrect Answers
A:Correlated records make future attribution defensible; this serves how to attribute network activity reliably, whereas the requested result is readiness improvement involving what triage must establish before closure.
B:Closure requires corroborating evidence and documented review; the goal is readiness improvement for what triage must establish before closure. Case recovery is not future-risk control.
D:Severity and scope cannot be inferred solely from a detector confidence score; the case needs readiness improvement addressing what triage must establish before closure; an investigation is not recurrence prevention.
Question 49
An immediate process decision is needed for the following concern: An intrusion drill finds that the isolation runbook references network ports moved during last quarter's redesign. Select TWO actions covering procedural assessment and an authorized near-term response—not full process redesign. (Choose TWO.)
- Confirm the correct enforcement point before pushing emergency blocks
- Revise and exercise the playbook against current network dependencies
- Validate the mitigation and partner connectivity before closing the change
- Treat infrastructure changes as triggers for playbook maintenance
- Compare the runbook network map with live segmentation and routing inventory
Explanation
Correct Answers
A:Targeted network action avoids isolating unrelated services; within the combined response for whether playbooks match current architecture, this supplies immediate response coordination: the immediate coordination decision concerns whether playbooks match current architecture; it keeps the response process under explicit control.
E:Outdated topology can make otherwise sound containment instructions ineffective; within the combined response for whether playbooks match current architecture, this supplies process validation: the review establishes whether playbooks match current architecture so that responsibility and next decisions rest on a recorded result.
Incorrect Answers
B:Tested updates restore confidence that specified actions will work; for whether playbooks match current architecture, corrective follow-through follows initial protection; immediate response coordination remains necessary.
C:Both threat containment and service availability must be checked; that method could help with the control approval missing from the change; the immediate response coordination decision here involves whether playbooks match current architecture.
D:Change-driven review prevents stale emergency instructions; the goal is immediate response coordination for whether playbooks match current architecture. Prevention cannot replace immediate action.
Question 50
Response staff seek a controlled first step after this problem: Incident owners repeatedly close cases without documenting root cause or detection gaps. The manager needs a check that verifies the issue AND an immediate controlled assignment or safeguard. Which TWO case-specific steps fulfill those distinct roles? (Choose TWO.)
- Reopen the improvement review and assign corrective-action owners
- Track detection and control fixes to evidence-backed completion
- Track root-cause remediation as a required closure dependency
- Require intake forms with time, source, severity, affected assets and owner
- Review closed case records for corrective actions and unresolved causal factors
- Make a blameless post-incident review a required high-severity milestone
Explanation
Correct Answers
A:A documented follow-up prevents recurring problems from being buried at closure; within the combined response for what post-incident learning is missing, this supplies immediate response coordination: this protective or assignment decision directly addresses what post-incident learning is missing while response governance is still active.
E:A complete lessons-learned record should identify why controls failed or succeeded; within the combined response for what post-incident learning is missing, this supplies process validation: this provides an auditable basis for the disputed finding: what post-incident learning is missing.
Incorrect Answers
B:Measured remediation converts the review into preventive change; the requirement concerns what post-incident learning is missing, so corrective follow-through follows initial protection.
C:Technical closure should include all enabling weaknesses, not just file removal; this serves whether eradication removed the attack's persistence, whereas the requested result is immediate response coordination involving what post-incident learning is missing.
D:Consistent minimum fields improve triage and handoff; this serves how incident recording supports traceability, whereas the requested result is immediate response coordination involving what post-incident learning is missing.
F:Structured learning improves response without punishing accurate reporting; when judging what post-incident learning is missing, prevention cannot replace immediate action; this is instead readiness improvement.
