Question 70
A response-governance owner reviews a documented failure: Law enforcement requests original disk evidence while the business intends to overwrite the device for restoration. Which targeted review or exercise would most directly validate this process gap?
- Confirm the lawful request, evidence scope and authorized custodian
- Determine data sensitivity, contractual scope and approved recipients
- Define legal-hold and release procedures in incident playbooks
- Preserve a verified forensic image and secure the original under chain of custody
Explanation
Correct Answer
A:The legal process and collection requirements determine what must be retained; the review establishes how to reconcile evidence preservation with operational recovery so that responsibility and next decisions rest on a recorded result.
Incorrect Answers
B:Evidence sharing can itself create unnecessary exposure when recipient authority is unverified; the relevant condition for that step is what authorization governs external evidence sharing, which is not shown for how to reconcile evidence preservation with operational recovery.
C:Clear handoffs reduce conflict between investigation and service recovery; prevention is not incident verification in the decision about how to reconcile evidence preservation with operational recovery.
D:Maintaining evidentiary integrity permits separate operational restoration decisions; the case needs process validation addressing how to reconcile evidence preservation with operational recovery; immediate protection does not substantiate findings.
Question 71
The organization needs to repair the response procedure after: Before a breach, the organization has no access to offline recovery credentials or responder contact numbers. Which step reconciles the actual actions with an approved incident plan?
- Exercise loss-of-domain and loss-of-email scenarios on a schedule
- Validate break-glass credentials and store approved recovery materials offline
- Recover deleted artifacts from approved sources and document irretrievable gaps
- Establish a secure out-of-band contact and emergency access procedure
Explanation
Correct Answer
B:Tested access restores operational capability without relying on compromised identity systems; procedural closure should resolve whether preparation includes out-of-band access in the incident record, not just remove a visible symptom.
Incorrect Answers
A:Practical drills expose hidden dependencies earlier than a paper review; the case needs procedural correction addressing whether preparation includes out-of-band access; future hardening is not current-state recovery.
C:Transparent reconstruction distinguishes recovered data from missing original evidence; it is meant to address why evidence collection must precede destructive remediation, not procedural correction for whether preparation includes out-of-band access.
D:Separating response communications from affected infrastructure sustains coordination; the requirement concerns whether preparation includes out-of-band access, so temporary protection does not complete correction.
Question 72
A procedural case requires a near-term protective assignment: A containment change was implemented on an internet router without notifying the network duty officer and broke partner connectivity. What near-term response-governance action should be taken while the issue is open?
- Validate the mitigation and partner connectivity before closing the change
- Centralize stakeholder communication under the incident commander and approved spokesperson
- Activate the emergency change coordination path and assess immediate rollback
- Predefine emergency network-change authorities and rollback criteria
- Compare the incident change ticket with the designated approval and escalation matrix
Explanation
Correct Answer
C:Controlled action restores oversight while limiting further incident exposure; the case needs an authorized near-term step for the control approval missing from the change, with longer-term playbook changes handled separately.
Incorrect Answers
A:Both threat containment and service availability must be checked; for the control approval missing from the change, corrective follow-through follows initial protection; immediate response coordination remains necessary.
B:Single-source approval reduces speculation and contradictory disclosures; the other incident centers on what made external incident messaging inconsistent, not this immediate response coordination question about the control approval missing from the change.
D:A tested authorization path prevents uncontrolled containment disruption; prevention cannot replace immediate action in the decision about the control approval missing from the change.
E:The record shows whether emergency authority and network coordination were followed; the case needs immediate response coordination addressing the control approval missing from the change; investigation alone does not control current conditions.
Question 73
The response coordinator tests a weakness described in these records: An orchestration playbook automatically isolates every host with a single low-confidence malware alert. What case-specific check would establish how this response procedure failed?
- Require analyst approval before high-impact isolation on ambiguous alerts
- Use risk-based automation tiers and rollback controls
- Review the playbook trigger thresholds and isolation execution logs
- Test revised triggers against representative benign and malicious alerts
- Enumerate the integration identity's effective permissions and target scopes
Explanation
Correct Answer
C:Comparing alert confidence to actions shows whether automation exceeded agreed risk tolerance; that check tests the risk of excessive automated containment without assuming that a policy citation alone proves operational compliance.
Incorrect Answers
A:A human gate limits business disruption while preserving rapid automated evidence gathering; for the risk of excessive automated containment, immediate protection does not substantiate findings; process validation remains necessary.
B:Different thresholds for enrichment and disruptive action make orchestration safer; the requirement concerns the risk of excessive automated containment, so prevention is not incident verification.
D:Simulation checks that the updated workflow reduces false containment; recovery is not factual verification in the decision about the risk of excessive automated containment.
E:Excessive cross-tenant grants increase the impact of automation mistakes; the other incident centers on whether orchestration violates least privilege, not this process validation question about the risk of excessive automated containment.
Question 74
A documented handling problem requires corrective follow-through: Incident owners repeatedly close cases without documenting root cause or detection gaps. What corrective record or operational change resolves this process weakness?
- Make a blameless post-incident review a required high-severity milestone
- Track detection and control fixes to evidence-backed completion
- Issue a corrected, fact-checked situation report with known uncertainties
- Reopen the improvement review and assign corrective-action owners
Explanation
Correct Answer
B:Measured remediation converts the review into preventive change; the affected handling process should be validated against what post-incident learning is missing after the change.
Incorrect Answers
A:Structured learning improves response without punishing accurate reporting; when judging what post-incident learning is missing, future hardening is not current-state recovery; this is instead readiness improvement.
C:Controlled updates restore reliable communication without asserting unverified facts; this serves what made external incident messaging inconsistent, whereas the requested result is procedural correction involving what post-incident learning is missing.
D:A documented follow-up prevents recurring problems from being buried at closure; the goal is procedural correction for what post-incident learning is missing. Temporary protection does not complete correction.
Question 75
Response staff seek a controlled first step after this problem: A ransomware alert has no assigned communication owner, and public relations releases contradictory information. Which immediate assignment, safeguard or coordination decision is justified?
- Issue a corrected, fact-checked situation report with known uncertainties
- Centralize stakeholder communication under the incident commander and approved spokesperson
- Activate the emergency change coordination path and assess immediate rollback
- Preassign spokespersons, approval gates and communication templates
- Compare incident command approvals with each outbound statement
Explanation
Correct Answer
B:Single-source approval reduces speculation and contradictory disclosures; the immediate coordination decision concerns what made external incident messaging inconsistent; it keeps the response process under explicit control.
Incorrect Answers
A:Controlled updates restore reliable communication without asserting unverified facts; the requirement concerns what made external incident messaging inconsistent, so corrective follow-through follows initial protection.
C:Controlled action restores oversight while limiting further incident exposure; the other incident centers on the control approval missing from the change, not this immediate response coordination question about what made external incident messaging inconsistent.
D:A rehearsal-tested plan makes crisis messages consistent; the case needs immediate response coordination addressing what made external incident messaging inconsistent; prevention cannot replace immediate action.
E:Missing authorization reveals why accounts of the event diverged; when judging what made external incident messaging inconsistent, investigation alone does not control current conditions; this is instead process validation.
Question 76
A procedural case requires a near-term protective assignment: A vendor asks a responder to forward raw incident logs containing personal identifiers to an unrelated external consultant. What response coordination or restriction step should take priority?
- Determine data sensitivity, contractual scope and approved recipients
- Use legal-approved minimum-necessary disclosure and secure transfer
- Preserve a verified forensic image and secure the original under chain of custody
- Log recipient, purpose, content and secure deletion or retention terms
Explanation
Correct Answer
B:Controlled release balances investigation needs with confidentiality obligations; this protective or assignment decision directly addresses what authorization governs external evidence sharing while response governance is still active.
Incorrect Answers
A:Evidence sharing can itself create unnecessary exposure when recipient authority is unverified; the goal is immediate response coordination for what authorization governs external evidence sharing. Investigation alone does not control current conditions.
C:Maintaining evidentiary integrity permits separate operational restoration decisions; the relevant condition for that step is how to reconcile evidence preservation with operational recovery, which is not shown for what authorization governs external evidence sharing.
D:A complete disclosure record supports accountability after the incident; when judging what authorization governs external evidence sharing, corrective follow-through follows initial protection; this is instead procedural correction.
Question 77
A long-term control assessment uses this recent event: A triage analyst has only an IP address from an old NAT gateway log and assigns the incident to the wrong user. Which change provides measurable prevention rather than an emergency workaround?
- Correlate source port, timestamp, NAT translation and identity session records
- Correct the case attribution and document uncertain mappings
- Use severity criteria combining confidence, criticality and potential data impact
- Retain synchronized NAT, DHCP and authentication logs at adequate granularity
Explanation
Correct Answer
D:Correlated records make future attribution defensible; this turns the weakness behind how to attribute network activity reliably into a measurable prevention requirement.
Incorrect Answers
A:Shared addresses cannot identify a unique user without translation and timing context; when judging how to attribute network activity reliably, an investigation is not recurrence prevention; this is instead process validation.
B:Traceable assumptions keep an investigation from building on false identity claims; for how to attribute network activity reliably, case recovery is not future-risk control; readiness improvement remains necessary.
C:Balanced triage avoids dismissing important uncertain alerts; this serves what triage must establish before closure, whereas the requested result is readiness improvement involving how to attribute network activity reliably.
Question 78
A documented handling problem requires corrective follow-through: An automated credential-revocation workflow succeeded in the identity provider but the ticket still reads pending. What corrective record or operational change resolves this process weakness?
- Repair the workflow callback and re-run an idempotent status check
- Manually verify the session is invalid before triggering another revocation
- Rotate its secret and reissue role grants after approval testing
- Monitor action completion receipts rather than workflow invocation alone
Explanation
Correct Answer
A:Idempotency avoids multiple side effects when a status update is retried; the affected handling process should be validated against why orchestration status differs from control state after the change.
Incorrect Answers
B:State checking prevents duplicate disruptive steps and allows safe incident progression; for why orchestration status differs from control state, temporary protection does not complete correction; procedural correction remains necessary.
C:Credential replacement and entitlement review restore trust in the integration; this serves whether orchestration violates least privilege, whereas the requested result is procedural correction involving why orchestration status differs from control state.
D:End-to-end confirmation catches silent integration and acknowledgement failures; the goal is procedural correction for why orchestration status differs from control state. Future hardening is not current-state recovery.
Question 79
An incident-process audit asks for a defensible finding about this case: The SOC calls every ATT&CK technique observed in logs a separate incident and loses the attack narrative. Which recorded evidence or practical test establishes the stated response-process issue?
- Train analysts to separate analytic technique tags from incident identifiers
- Examine the profile's Govern, Identify, Protect, Detect, Respond and Recover functions
- Correlate technique observations by actor activity, time and affected assets
- Group related detections into a single managed incident when supported by evidence
Explanation
Correct Answer
C:ATT&CK classifies behavior, while incident scope depends on connected events and impact; this provides an auditable basis for the disputed finding: how technique mapping relates to incident grouping.
Incorrect Answers
A:Consistent taxonomy prevents misleading case counts; the goal is process validation for how technique mapping relates to incident grouping. Prevention is not incident verification.
B:These risk-management outcomes do not prescribe bit-for-bit disk imaging procedures; it is meant to address what CSF 2.0 actually organizes, not process validation for how technique mapping relates to incident grouping.
D:Correlation improves coordinated containment and avoids fragmented response; when judging how technique mapping relates to incident grouping, immediate protection does not substantiate findings; this is instead immediate response coordination.
Question 80
Before revising the playbook, the incident manager checks the following: An organization has a CSF 2.0 profile but incorrectly claims it is a forensic evidence acquisition standard. Which audit, correlation or test best verifies the reported governance weakness?
- Map incident response capabilities to CSF functions and forensic SOPs
- Examine the profile's Govern, Identify, Protect, Detect, Respond and Recover functions
- Check the publication revision and supersession notice in NIST CSRC
- Maintain clear mappings between strategic frameworks and tactical procedures
- Use a separate validated forensic procedure for evidence handling
Explanation
Correct Answer
B:These risk-management outcomes do not prescribe bit-for-bit disk imaging procedures; this provides an auditable basis for the disputed finding: what CSF 2.0 actually organizes.
Incorrect Answers
A:Complementary guidance avoids treating a framework as a detailed tool runbook; when judging what CSF 2.0 actually organizes, recovery is not factual verification; this is instead procedural correction.
C:NIST finalized Revision 3 in April 2025, replacing the 2012 guide; this serves whether cited incident-response guidance is current, whereas the requested result is process validation involving what CSF 2.0 actually organizes.
D:Document clarity prevents responders from expecting nonexistent implementation instructions; the goal is process validation for what CSF 2.0 actually organizes. Prevention is not incident verification.
E:Specific acquisition methods are still needed alongside strategic cybersecurity outcomes; immediate protection does not substantiate findings in the decision about what CSF 2.0 actually organizes.
