Question 650
Before destructive cleanup is authorized, the team faces this situation: A vendor remote access appliance shows an unauthorized session using an expired maintenance account. Which protective response should the coordinator authorize now?
- Terminate the tunnel and restrict unauthorized SSH egress from the host
- Disable the obsolete vendor account and terminate its active connections
- Correlate appliance auth logs with vendor account lifecycle and maintenance schedule
- Expire vendor access automatically and grant just-in-time maintenance privileges
- Rotate affected appliance secrets and investigate actions during the session
Explanation
Correct Answer
B:Immediate identity revocation cuts off the remote path; this reduces current exposure associated with whether old vendor identities are still enabled and permits later corrective work.
Incorrect Answers
A:Blocking the control path limits remote database reachability; the other incident centers on whether outbound encrypted traffic enables inbound control, not this initial containment or preservation question about whether old vendor identities are still enabled.
C:Stale credentials can remain functional after the business need ends; the goal is initial containment or preservation for whether old vendor identities are still enabled. Investigation alone does not control current conditions.
D:Time-bounded external access reduces dormant entry points; prevention cannot replace immediate action in the decision about whether old vendor identities are still enabled.
E:Cleanup must inspect what the unauthorized login changed; the case needs initial containment or preservation addressing whether old vendor identities are still enabled; corrective follow-through follows initial protection.
Question 651
The affected workflow needs an integrity and access check following this event: A VPN account authenticates successfully from two distant regions minutes apart with unusual device fingerprints. What case-specific cleanup or recovery step establishes a trusted state?
- Restore trusted switch configuration and rotate administration credentials
- Revoke suspicious VPN sessions and impose a targeted account challenge
- Rotate compromised credentials and inspect accessed internal resources
- Enforce device trust and phishing-resistant MFA on remote access
Explanation
Correct Answer
C:Removing the active session does not resolve subsequent unauthorized activity; the change should be tested before unrestricted operations resume for the event involving whether the login pattern indicates credential abuse.
Incorrect Answers
A:Remediation must address both setup and access method; it is meant to address whether configuration change enabled traffic interception, not trusted restoration for whether the login pattern indicates credential abuse.
B:Identity containment interrupts remote access while investigation continues; temporary protection does not complete correction in the decision about whether the login pattern indicates credential abuse.
D:Strong access controls reduce replay of stolen passwords; when judging whether the login pattern indicates credential abuse, future hardening is not current-state recovery; this is instead recurrence prevention.
Question 652
A tabletop exercise is being updated using the following real-world failure: A corporate Wi-Fi client associates to an unknown access point through a weak pre-shared key reused at a partner site. Which improvement should be tracked through the next control-assurance cycle?
- Prefer per-user or per-device enterprise authentication over shared PSKs
- Deploy locked-down device WLAN profiles and certificate-based authentication
- Rotate the exposed key and remove the unapproved device from coverage
- Re-enroll legitimate clients onto a controlled WLAN configuration
- Review access point authentication events and key distribution history
Explanation
Correct Answer
A:Unique credentials enable revocation and accountability; the assurance measure is designed around whether PSK exposure allows unauthorized association, rather than hiding the reported activity.
Incorrect Answers
B:Managed association policies prevent accidental insecure roaming; the activity targets whether client misassociation caused insecure traffic; recurrence prevention here concerns whether PSK exposure allows unauthorized association.
C:Containment blocks continued access using the reused secret; the case needs recurrence prevention addressing whether PSK exposure allows unauthorized association; one-time protection is not durable prevention.
D:A safe migration restores secure connectivity; when judging whether PSK exposure allows unauthorized association, case recovery is not future-risk control; this is instead trusted restoration.
E:A shared passphrase does not distinguish authorized users individually; for whether PSK exposure allows unauthorized association, an investigation is not recurrence prevention; recurrence prevention remains necessary.
Question 653
The team has retained the initial evidence and is assessing recovery from: A compromised identity establishes a reverse SSH tunnel from a database host to an external server. What restoration task closes the identified integrity or control gap?
- Terminate the tunnel and restrict unauthorized SSH egress from the host
- Rotate local administrator passwords and inspect altered server configurations
- Manage SSH keys centrally and alert on unexpected remote port forwarding
- Remove unauthorized keys and startup entries and rotate exposed credentials
Explanation
Correct Answer
D:Eradication closes both access and persistence mechanisms; the resulting state needs verification against the original concern: whether outbound encrypted traffic enables inbound control.
Incorrect Answers
A:Blocking the control path limits remote database reachability; the goal is trusted restoration for whether outbound encrypted traffic enables inbound control. Temporary protection does not complete correction.
B:Access removal should precede reintegration of affected servers; that method could help with whether local credential reuse enabled RDP spread; the trusted restoration decision here involves whether outbound encrypted traffic enables inbound control.
C:Controls reduce covert tunneling through legitimate tools; the case needs trusted restoration addressing whether outbound encrypted traffic enables inbound control; future hardening is not current-state recovery.
Question 654
The first task is to corroborate an alert. The case notes state: A remote access system allows stale machine certificates after corporate laptops are retired. What should the investigator examine to distinguish a substantiated finding from an assumption?
- Revoke certificates tied to lost or retired devices and terminate active sessions
- Link device decommissioning with certificate revocation and VPN policy
- Inspect certificate issuance, revocation status and device access events
- Correlate appliance auth logs with vendor account lifecycle and maintenance schedule
Explanation
Correct Answer
C:An old certificate can remain valid after asset ownership changes; this permits a traceable finding about whether certificate trust still authorizes retired devices before the team makes a disruptive change.
Incorrect Answers
A:Identity revocation closes the device-authentication path; the requirement concerns whether certificate trust still authorizes retired devices, so immediate protection does not substantiate findings.
B:Lifecycle integration prevents orphaned trust; the goal is evidence validation for whether certificate trust still authorizes retired devices. Prevention is not incident verification.
D:Stale credentials can remain functional after the business need ends; the other incident centers on whether old vendor identities are still enabled, not this evidence validation question about whether certificate trust still authorizes retired devices.
Question 655
Before making any disruptive change, an investigator is handed these observations: Firewall logs show SYN packets to hundreds of ports on one server, but no completed application sessions. Which source best supports the incident finding before responders modify the environment?
- Alert on reconnaissance followed by successful authentication or exploit evidence
- Rate-limit or block the scanner while watching for subsequent successful access
- Correlate SYN and response patterns with successful handshakes and service logs
- Cross-check firewall disposition with internal server connection and process logs
Explanation
Correct Answer
C:Incomplete connection attempts suggest reconnaissance but do not prove application compromise; the review should retain source and timing information relevant to whether the traffic represents probing rather than established access.
Incorrect Answers
A:Multi-stage detection prioritizes consequential activity; the case needs evidence validation addressing whether the traffic represents probing rather than established access; prevention is not incident verification.
B:A targeted block reduces exposure without asserting a breach; when judging whether the traffic represents probing rather than established access, immediate protection does not substantiate findings; this is instead initial containment or preservation.
D:An IDS signature in dropped traffic does not prove successful execution; this serves whether exploit attempts reached a vulnerable host, whereas the requested result is evidence validation involving whether the traffic represents probing rather than established access.
Question 656
The response record begins with an unresolved observation: A network incident runbook directs staff to block an IP at a decommissioned firewall rather than the current edge gateway. What documentation or telemetry would most reliably support the incident determination?
- Compare topology documentation and active routing with the referenced firewall path
- Trigger playbook review after network migrations and segmentation changes
- Compare current running configuration with an independently retained approved backup
- Update containment diagrams and perform an end-to-end blocking test
- Identify the actual transit control before applying an approved block
Explanation
Correct Answer
A:An obsolete enforcement point cannot stop traffic that bypasses it; the objective is to establish whether emergency network enforcement points are current; the result can then guide the later protective decision.
Incorrect Answers
B:Change-aware documentation keeps emergency instructions usable; the goal is evidence validation for whether emergency network enforcement points are current. Prevention is not incident verification.
C:A local copy could share the compromised state or have been overwritten; the activity targets whether trusted baseline configurations are available; evidence validation here concerns whether emergency network enforcement points are current.
D:A verified rule should take effect where intended; the case needs evidence validation addressing whether emergency network enforcement points are current; recovery is not factual verification.
E:The response must interrupt the live packet path without damaging unrelated routes; when judging whether emergency network enforcement points are current, immediate protection does not substantiate findings; this is instead authorized visibility or enforcement preparation.
Question 657
The responder must establish the timeline from this observation: DNS monitoring reports many TXT lookups containing unusually long random strings from a single host. Which analysis step best addresses the missing confirmation?
- Check sensor decryption capabilities and available HTTP transaction logs
- Inspect query lengths, label entropy, resolver logs and initiating process
- Limit the suspect host's DNS egress to approved resolvers and isolate as needed
- Alert on abnormal DNS volume, entropy and uncommon query patterns
Explanation
Correct Answer
B:Encoded payloads often manifest as repetitive atypical labels and record usage; that evidence directly tests the concern about whether DNS tunneling may carry encoded data, rather than relying on a single unverified indicator.
Incorrect Answers
A:Encrypted packets alone do not reveal plaintext request parameters to a passive sensor; it is meant to address whether the alert was based on decrypted application content, not evidence validation for whether DNS tunneling may carry encoded data.
C:Routing control interrupts covert outbound channels; for whether DNS tunneling may carry encoded data, immediate protection does not substantiate findings; evidence validation remains necessary.
D:Behavioral controls identify tunneling variants; the requirement concerns whether DNS tunneling may carry encoded data, so prevention is not incident verification.
Question 658
While full remediation remains pending, the commander receives this incident report: Packet captures are available but no sensor covers the segment between two data-center application tiers. Which authorized first action best closes the immediate evidence or enforcement-point gap?
- Test network visibility during red-team and incident exercises
- Enable scoped capture at an authorized aggregation or switch mirror point
- Deploy appropriate east-west sensors and verify collection accuracy
- Map sensor placement against the observed inter-tier route
- Restrict administrative changes and preserve current configuration evidence
Explanation
Correct Answer
B:Targeted visibility supports analysis without changing endpoint state; this prepares a safe evidence or control pathway for whether network monitoring sees suspected east-west movement before further operational changes.
Incorrect Answers
A:Coverage validation reveals gaps missed by perimeter-only monitoring; the case needs authorized visibility or enforcement preparation addressing whether network monitoring sees suspected east-west movement; prevention cannot replace immediate action.
C:Persistent coverage should include high-value internal paths; for whether network monitoring sees suspected east-west movement, corrective follow-through follows initial protection; authorized visibility or enforcement preparation remains necessary.
D:A blind spot can explain why lateral traffic is absent from telemetry; the requirement concerns whether network monitoring sees suspected east-west movement, so investigation alone does not control current conditions.
E:Containment should prevent additional tampering before correction; the activity targets whether trusted baseline configurations are available; authorized visibility or enforcement preparation here concerns whether network monitoring sees suspected east-west movement.
Question 659
The team wants a measurable hardening change following this situation: Access logs show unauthorized RDP logins from one workstation to several servers using a privileged local account. What improvement best addresses the root weakness in a future incident?
- Use unique local admin credentials and restrict RDP to managed jump hosts
- Require peer-reviewed policy-as-code checks for management ingress
- Compare RDP logon events, source identifiers and reused account names
- Rotate local administrator passwords and inspect altered server configurations
Explanation
Correct Answer
A:Tiered remote management reduces lateral exposure; the ongoing control is targeted at whether local credential reuse enabled RDP spread, rather than a one-time emergency fix.
Incorrect Answers
B:Preventive validation catches broad administrator access rules; the other incident centers on which configuration allowed unauthorized administrative reachability, not this recurrence prevention question about whether local credential reuse enabled RDP spread.
C:Repeated privileged remote logons indicate likely credential-driven movement; an investigation is not recurrence prevention in the decision about whether local credential reuse enabled RDP spread.
D:Access removal should precede reintegration of affected servers; the case needs recurrence prevention addressing whether local credential reuse enabled RDP spread; case recovery is not future-risk control.
Question 660
During lessons learned, the security owner reviews this completed incident: A wireless security survey detects an access point advertising the approved SSID from a location outside the building. Which repeatable safeguard best prevents this failure mode in the future?
- Compare BSSID, hardware inventory and measured signal location
- Remove confirmed unauthorized equipment and review any associated clients
- Maintain wireless intrusion detection and approved AP inventories
- Enforce validated enterprise WLAN certificates and managed network profiles
Explanation
Correct Answer
C:Continuous comparison detects new unauthorized radios; the assurance measure is designed around whether the radio is authorized infrastructure, rather than hiding the reported activity.
Incorrect Answers
A:SSID names are not proof of asset ownership; the case needs recurrence prevention addressing whether the radio is authorized infrastructure; an investigation is not recurrence prevention.
B:A rogue device may have captured traffic or credentials; when judging whether the radio is authorized infrastructure, case recovery is not future-risk control; this is instead trusted restoration.
D:Client authentication helps prevent evil-twin connections; this serves whether an evil twin access point is impersonating the SSID, whereas the requested result is recurrence prevention involving whether the radio is authorized infrastructure.
