Question 550
A triage analyst needs to test a report involving these details: A router configuration backup exists only on the router that may have been modified by an intruder. Which evidence collection or correlation is most relevant to this claim?
- Compare topology documentation and active routing with the referenced firewall path
- Maintain immutable off-device network configuration backups
- Restrict administrative changes and preserve current configuration evidence
- Restore a verified approved configuration and rotate device administration secrets
- Compare current running configuration with an independently retained approved backup
Explanation
Correct Answer
E:A local copy could share the compromised state or have been overwritten; the review should retain source and timing information relevant to whether trusted baseline configurations are available.
Incorrect Answers
A:An obsolete enforcement point cannot stop traffic that bypasses it; the other incident centers on whether emergency network enforcement points are current, not this evidence validation question about whether trusted baseline configurations are available.
B:Independent baselines support dependable incident recovery; prevention is not incident verification in the decision about whether trusted baseline configurations are available.
C:Containment should prevent additional tampering before correction; the case needs evidence validation addressing whether trusted baseline configurations are available; immediate protection does not substantiate findings.
D:A known-good baseline addresses configuration and credential compromise; when judging whether trusted baseline configurations are available, recovery is not factual verification; this is instead trusted restoration.
Question 551
Before destructive cleanup is authorized, the team faces this situation: Wireless monitoring detects repeated deauthentication frames that disconnect staff devices from legitimate access points. Which protective response should the coordinator authorize now?
- Validate AP firmware, client behavior and stable reconnection after mitigation
- Locate the interference source and follow authorized radio incident procedures
- Initiate a scoped rogue-AP investigation and protect clients from association
- Examine 802.11 management frame capture, source addresses and AP association events
Explanation
Correct Answer
B:Physical investigation and client protection are safer than unauthorized jamming; the action limits the impact connected to whether management-frame abuse is causing client disruption without assuming the underlying flaw is already gone.
Incorrect Answers
A:Recovery must show normal wireless service; for whether management-frame abuse is causing client disruption, corrective follow-through follows initial protection; initial containment or preservation remains necessary.
C:Containment follows authorized wireless response channels; it is meant to address whether the radio is authorized infrastructure, not initial containment or preservation for whether management-frame abuse is causing client disruption.
D:Deauthentication floods can cause disconnections without normal data traffic; investigation alone does not control current conditions in the decision about whether management-frame abuse is causing client disruption.
Question 552
Service owners need a bounded short-term safeguard after observing: Firewall logs show SYN packets to hundreds of ports on one server, but no completed application sessions. What immediate action addresses the active exposure and leaves evidence available?
- Keep the block and hunt for alternate successful paths rather than reimaging immediately
- Rate-limit or block the scanner while watching for subsequent successful access
- Correlate SYN and response patterns with successful handshakes and service logs
- Review service exposure and document the scan disposition and observed impact
- Alert on reconnaissance followed by successful authentication or exploit evidence
Explanation
Correct Answer
B:A targeted block reduces exposure without asserting a breach; it restricts the path implicated in whether the traffic represents probing rather than established access; later eradication and restoration remain separate decisions.
Incorrect Answers
A:Risk-based response follows evidence of actual access; that method could help with whether exploit attempts reached a vulnerable host; the initial containment or preservation decision here involves whether the traffic represents probing rather than established access.
C:Incomplete connection attempts suggest reconnaissance but do not prove application compromise; the requirement concerns whether the traffic represents probing rather than established access, so investigation alone does not control current conditions.
D:A controlled assessment distinguishes prevented probes from penetration; the goal is initial containment or preservation for whether the traffic represents probing rather than established access. Corrective follow-through follows initial protection.
E:Multi-stage detection prioritizes consequential activity; prevention cannot replace immediate action in the decision about whether the traffic represents probing rather than established access.
Question 553
During lessons learned, the security owner reviews this completed incident: A VPN account authenticates successfully from two distant regions minutes apart with unusual device fingerprints. Which repeatable safeguard best prevents this failure mode in the future?
- Enforce device trust and phishing-resistant MFA on remote access
- Correlate VPN session IDs, MFA events, device identifiers and geolocation context
- Revoke suspicious VPN sessions and impose a targeted account challenge
- Link device decommissioning with certificate revocation and VPN policy
- Rotate compromised credentials and inspect accessed internal resources
Explanation
Correct Answer
A:Strong access controls reduce replay of stolen passwords; the control owner can test whether this reduces repeat conditions affecting whether the login pattern indicates credential abuse.
Incorrect Answers
B:Impossible-travel-like signals require corroboration with session and proxy context; when judging whether the login pattern indicates credential abuse, an investigation is not recurrence prevention; this is instead evidence validation.
C:Identity containment interrupts remote access while investigation continues; for whether the login pattern indicates credential abuse, one-time protection is not durable prevention; recurrence prevention remains necessary.
D:Lifecycle integration prevents orphaned trust; the relevant condition for that step is whether certificate trust still authorizes retired devices, which is not shown for whether the login pattern indicates credential abuse.
E:Removing the active session does not resolve subsequent unauthorized activity; the goal is recurrence prevention for whether the login pattern indicates credential abuse. Case recovery is not future-risk control.
Question 554
The incident is not yet closed. Response staff report: A remote access system allows stale machine certificates after corporate laptops are retired. Which short-term measure protects the affected process or asset?
- Revoke suspicious VPN sessions and impose a targeted account challenge
- Inspect certificate issuance, revocation status and device access events
- Revoke certificates tied to lost or retired devices and terminate active sessions
- Link device decommissioning with certificate revocation and VPN policy
- Reissue trust only to inventoried compliant devices
Explanation
Correct Answer
C:Identity revocation closes the device-authentication path; this is a first-response safeguard for whether certificate trust still authorizes retired devices, not a substitute for full root-cause analysis.
Incorrect Answers
A:Identity containment interrupts remote access while investigation continues; the relevant condition for that step is whether the login pattern indicates credential abuse, which is not shown for whether certificate trust still authorizes retired devices.
B:An old certificate can remain valid after asset ownership changes; for whether certificate trust still authorizes retired devices, investigation alone does not control current conditions; initial containment or preservation remains necessary.
D:Lifecycle integration prevents orphaned trust; the goal is initial containment or preservation for whether certificate trust still authorizes retired devices. Prevention cannot replace immediate action.
E:Recovery restores accountable device access; corrective follow-through follows initial protection in the decision about whether certificate trust still authorizes retired devices.
Question 555
To avoid broad unnecessary disruption, responders consider this finding: An employee uses a corporate proxy to upload classified engineering files to an unauthorized personal cloud account. Which operational control should take effect first?
- Join proxy upload metadata with data classification and employee identity
- Block the unapproved upload channel and preserve evidence for HR and security review
- Assess transferred information and revoke unsanctioned sharing links where possible
- Block unapproved tunnel clients through application-aware controls
Explanation
Correct Answer
B:Response should stop further disclosure while respecting due process; the action limits the impact connected to whether network policy misuse caused data leakage without assuming the underlying flaw is already gone.
Incorrect Answers
A:Approved browser access does not authorize transfers of restricted information; the goal is initial containment or preservation for whether network policy misuse caused data leakage. Investigation alone does not control current conditions.
C:Recovery addresses data exposure rather than only browsing access; the case needs initial containment or preservation addressing whether network policy misuse caused data leakage; corrective follow-through follows initial protection.
D:Containment restores monitored egress paths while preserving logs; the activity targets whether unsanctioned tunneling bypasses inspection; initial containment or preservation here concerns whether network policy misuse caused data leakage.
Question 556
Post-containment analysis identified this issue for correction: A research lab's network is used to run unauthorized cryptomining over an allowed outbound port. Which remediation is supported by the observed root-cause conditions?
- Terminate unauthorized mining communications and notify system ownership
- Remove mining software and inspect for credential theft or persistence
- Use egress controls and workload accounting alerts on shared compute systems
- Investigate sending code and remove any unwanted scheduled tasks
Explanation
Correct Answer
B:Unexpected mining may be a symptom of broader compromise; the owner can validate the correction against the evidence bearing on whether resource consumption is policy abuse or sanctioned computation.
Incorrect Answers
A:Stopping abuse reduces resource and reputation impact; for whether resource consumption is policy abuse or sanctioned computation, temporary protection does not complete correction; trusted restoration remains necessary.
C:Visibility reduces hidden misuse; the goal is trusted restoration for whether resource consumption is policy abuse or sanctioned computation. Future hardening is not current-state recovery.
D:Restoration requires eliminating the email source; it is meant to address whether host misuse is causing outbound abuse, not trusted restoration for whether resource consumption is policy abuse or sanctioned computation.
Question 557
Cleanup is not considered complete. The case record describes: An employee routes corporate traffic through an unauthorized consumer VPN service to evade approved content restrictions. Which remediation task is necessary rather than merely suppressing the visible symptom?
- Enforce managed egress gateways and approved VPN clients
- Block unapproved tunnel clients through application-aware controls
- Remove the tunnel client and review affected access and policy violations
- Remove rogue client persistence and review accessed resources and credentials
Explanation
Correct Answer
C:Response should determine whether sensitive data crossed the alternate channel; the affected workflow should not be considered trusted until the issue of whether unsanctioned tunneling bypasses inspection is resolved.
Incorrect Answers
A:Controlled routes make misuse easier to detect; the requirement concerns whether unsanctioned tunneling bypasses inspection, so future hardening is not current-state recovery.
B:Containment restores monitored egress paths while preserving logs; the goal is trusted restoration for whether unsanctioned tunneling bypasses inspection. Temporary protection does not complete correction.
D:Cleanup must account for what remote operators may have done; it is meant to address whether tunneled remote administration violates access policy, not trusted restoration for whether unsanctioned tunneling bypasses inspection.
Question 558
A control owner is preparing preventive actions after observing: A volumetric UDP flood saturates the organization's upstream internet link before traffic reaches local firewalls. What tested hardening or process measure follows from the lessons learned?
- Arrange upstream DDoS capacity and tune SYN flood protection
- Validate legitimate traffic paths and withdraw emergency routing changes safely
- Contract upstream DDoS response and exercise traffic diversion
- Compare provider interface utilization with local device counters
Explanation
Correct Answer
C:Preparation matters when local controls cannot see all attack packets; it makes the lesson about where traffic must be filtered to restore availability part of normal operations.
Incorrect Answers
A:Perimeter resources alone may fail against large distributed attacks; it is meant to address whether state exhaustion is driving the outage, not recurrence prevention for where traffic must be filtered to restore availability.
B:Post-attack checks should confirm service and route stability; for where traffic must be filtered to restore availability, case recovery is not future-risk control; recurrence prevention remains necessary.
D:If the circuit is saturated upstream, on-premises drops cannot free the link; the goal is recurrence prevention for where traffic must be filtered to restore availability. An investigation is not recurrence prevention.
Question 559
A long-term control assessment uses this recent event: A user operates an unapproved remote desktop relay over HTTPS, bypassing the organization's remote access gateway. Which change provides measurable prevention rather than an emergency workaround?
- Remove rogue client persistence and review accessed resources and credentials
- Inspect proxy destinations, executable signatures and active remote sessions
- Use application-aware proxy policies and allowlisted remote support tools
- Enforce managed egress gateways and approved VPN clients
Explanation
Correct Answer
C:Approved remote paths provide audit and access controls; this turns the weakness behind whether tunneled remote administration violates access policy into a measurable prevention requirement.
Incorrect Answers
A:Cleanup must account for what remote operators may have done; the goal is recurrence prevention for whether tunneled remote administration violates access policy. Case recovery is not future-risk control.
B:Ordinary TLS does not imply the session followed approved remote management controls; an investigation is not recurrence prevention in the decision about whether tunneled remote administration violates access policy.
D:Controlled routes make misuse easier to detect; that method could help with whether unsanctioned tunneling bypasses inspection; the recurrence prevention decision here involves whether tunneled remote administration violates access policy.
Question 560
A security analyst is asked to validate the following reported behavior: An attacker uses a compromised switch management account to add a port mirror toward an unauthorized collector. Which check can confirm the relevant facts before a disruptive action?
- Inspect switch configuration diff, command audit and physical port inventory
- Use reviewed network-device configuration management and admin MFA
- Review rule hit logs, deployment diff and management-plane listening interfaces
- Restore trusted switch configuration and rotate administration credentials
- Disable the unauthorized mirror and restrict compromised management access
Explanation
Correct Answer
A:A mirror configuration can reveal confidential traffic without changing production routes; for this investigation, the relevant uncertainty is whether configuration change enabled traffic interception, so independent confirmation matters.
Incorrect Answers
B:Change control exposes covert monitoring configuration; prevention is not incident verification in the decision about whether configuration change enabled traffic interception.
C:A broad source range can expose administrative services beyond intended operators; the relevant condition for that step is which configuration allowed unauthorized administrative reachability, which is not shown for whether configuration change enabled traffic interception.
D:Remediation must address both setup and access method; when judging whether configuration change enabled traffic interception, recovery is not factual verification; this is instead trusted restoration.
E:Stopping the copy path limits continued interception; for whether configuration change enabled traffic interception, immediate protection does not substantiate findings; evidence validation remains necessary.
