Question 310 A manager asks investigators to search an employee's personal cloud account without legal authorization. What boundary applies? Conduct a controlled parallel recovery test with independent processing comparison Confirm investigative authority, scope and privacy obligations before collecting personal data Use approved order-of-volatility procedures while recording the system's operational state Separate verified facts, forensic hypotheses and attribution conclusions in the report Explanation Correct Answer B:Technical capability does not replace lawful permission to acquire evidence. Incorrect Answers A:For the separate situation in which a regulator wants proof that the organization can operate from its alternate data center while the primary remains live, parallel tests exercise the alternate environment without intentionally interrupting primary service; here the stated problem requires confirm investigative authority, scope and privacy obligations before collecting personal data. C:For the separate situation in which an incident team finds volatile memory evidence on a running server that may be lost at shutdown, evidence acquisition must balance rapidly disappearing artifacts against disruption and provenance; here the stated problem requires confirm investigative authority, scope and privacy obligations before collecting personal data. D:The other scenario states that a security report mixes observed malware indicators with an unsupported accusation against a named employee, where objective investigation preserves evidentiary quality and avoids premature blame; by contrast, the present case requires confirm investigative authority, scope and privacy obligations before collecting personal data.
Question 311 An incident team finds volatile memory evidence on a running server that may be lost at shutdown. What should guide collection? Use approved order-of-volatility procedures while recording the system's operational state Confirm investigative authority, scope and privacy obligations before collecting personal data Preserve evidence and coordinate containment under the authorized incident process Compute and record evidence hashes, custody and acquisition details at collection Explanation Correct Answer A:Evidence acquisition must balance rapidly disappearing artifacts against disruption and provenance. Incorrect Answers B:For the separate situation in which a manager asks investigators to search an employee's personal cloud account without legal authorization, technical capability does not replace lawful permission to acquire evidence; here the stated problem requires use approved order-of-volatility procedures while recording the system's operational state. C:For the separate situation in which the SOC confirms suspicious account access and wants to immediately delete every log to prevent panic, destroying telemetry undermines investigation and can breach reporting obligations; here the stated problem requires use approved order-of-volatility procedures while recording the system's operational state. D:This option fits a different fact pattern where a responder copies a compromised disk image but cannot demonstrate it was unchanged before analysis: integrity verification and traceable handling support forensic reliability; the current case instead requires use approved order-of-volatility procedures while recording the system's operational state.
Question 312 A security report mixes observed malware indicators with an unsupported accusation against a named employee. What should change? Use approved order-of-volatility procedures while recording the system's operational state Compute and record evidence hashes, custody and acquisition details at collection Separate verified facts, forensic hypotheses and attribution conclusions in the report Enforce versioned, attributable change tracking and approval for rule updates Explanation Correct Answer C:Objective investigation preserves evidentiary quality and avoids premature blame. Incorrect Answers A:For the separate situation in which an incident team finds volatile memory evidence on a running server that may be lost at shutdown, evidence acquisition must balance rapidly disappearing artifacts against disruption and provenance; here the stated problem requires separate verified facts, forensic hypotheses and attribution conclusions in the report. B:The other scenario states that a responder copies a compromised disk image but cannot demonstrate it was unchanged before analysis, where integrity verification and traceable handling support forensic reliability; by contrast, the present case requires separate verified facts, forensic hypotheses and attribution conclusions in the report. D:This option fits a different fact pattern where an automation tool changes production firewall rules without change records: configuration automation requires accountability and rollback, not just speed; the current case instead requires separate verified facts, forensic hypotheses and attribution conclusions in the report.
Question 313 A SIEM rule fires thousands of times on harmless administrative activity. How should operations improve detection? Tune the rule using validated context and false-positive evidence while preserving important coverage Validate intelligence relevance, freshness and false-positive impact before enforcement Add authorized egress monitoring and correlate traffic with asset and identity context Use behavioral anomaly analytics with contextual investigation before treating the alert as malicious Explanation Correct Answer A:Excessive noise lowers response effectiveness and can hide real incidents. Incorrect Answers B:This option fits a different fact pattern where a business ingests threat feeds automatically into blocking rules without evaluating quality: unvetted indicators can block legitimate operations or be stale; the current case instead requires tune the rule using validated context and false-positive evidence while preserving important coverage. C:The other scenario states that an organization collects perimeter firewall logs but never observes outbound traffic from servers, where outbound signals can reveal exfiltration or command-and-control missed at ingress; by contrast, the present case requires tune the rule using validated context and false-positive evidence while preserving important coverage. D:Behavioral detection identifies deviations but needs validation to avoid unjustified conclusions; this responds to the different circumstance in which an analyst notices unusual data transfer by a user whose activity otherwise appears authorized, while the current case states that a SIEM rule fires thousands of times on harmless administrative activity, calling for tune the rule using validated context and false-positive evidence while preserving important coverage.
Question 314 An organization collects perimeter firewall logs but never observes outbound traffic from servers. What visibility gap should be closed? Validate intelligence relevance, freshness and false-positive impact before enforcement Assess impact, authorize the change and prepare tested rollback before deployment Use behavioral anomaly analytics with contextual investigation before treating the alert as malicious Add authorized egress monitoring and correlate traffic with asset and identity context Explanation Correct Answer D:Outbound signals can reveal exfiltration or command-and-control missed at ingress. Incorrect Answers A:Unvetted indicators can block legitimate operations or be stale; although this helps when a business ingests threat feeds automatically into blocking rules without evaluating quality, it leaves the current case's need to add authorized egress monitoring and correlate traffic with asset and identity context unresolved. B:For the separate situation in which a firewall modification is applied on Friday with no rollback plan and breaks payroll, approved risk and recovery arrangements reduce business disruption from security changes; here the stated problem requires add authorized egress monitoring and correlate traffic with asset and identity context. C:The other scenario states that an analyst notices unusual data transfer by a user whose activity otherwise appears authorized, where behavioral detection identifies deviations but needs validation to avoid unjustified conclusions; by contrast, the present case requires add authorized egress monitoring and correlate traffic with asset and identity context.
Question 315 An analyst notices unusual data transfer by a user whose activity otherwise appears authorized. Which analysis can help? Tune the rule using validated context and false-positive evidence while preserving important coverage Add authorized egress monitoring and correlate traffic with asset and identity context Compute and record evidence hashes, custody and acquisition details at collection Use behavioral anomaly analytics with contextual investigation before treating the alert as malicious Explanation Correct Answer D:Behavioral detection identifies deviations but needs validation to avoid unjustified conclusions. Incorrect Answers A:The other scenario states that a SIEM rule fires thousands of times on harmless administrative activity, where excessive noise lowers response effectiveness and can hide real incidents; by contrast, the present case requires use behavioral anomaly analytics with contextual investigation before treating the alert as malicious. B:The other scenario states that an organization collects perimeter firewall logs but never observes outbound traffic from servers, where outbound signals can reveal exfiltration or command-and-control missed at ingress; by contrast, the present case requires use behavioral anomaly analytics with contextual investigation before treating the alert as malicious. C:The other scenario states that a responder copies a compromised disk image but cannot demonstrate it was unchanged before analysis, where integrity verification and traceable handling support forensic reliability; by contrast, the present case requires use behavioral anomaly analytics with contextual investigation before treating the alert as malicious.
Question 316 A business ingests threat feeds automatically into blocking rules without evaluating quality. What should be added? Increase validated recovery-point frequency or replication to meet the business RPO Validate intelligence relevance, freshness and false-positive impact before enforcement Use behavioral anomaly analytics with contextual investigation before treating the alert as malicious Add authorized egress monitoring and correlate traffic with asset and identity context Explanation Correct Answer B:Unvetted indicators can block legitimate operations or be stale. Incorrect Answers A:For the separate situation in which an application meets uptime requirements but its recovery data can lose 36 hours despite a one-hour RPO, availability targets do not guarantee sufficiently recent recoverable state; here the stated problem requires validate intelligence relevance, freshness and false-positive impact before enforcement. C:For the separate situation in which an analyst notices unusual data transfer by a user whose activity otherwise appears authorized, behavioral detection identifies deviations but needs validation to avoid unjustified conclusions; here the stated problem requires validate intelligence relevance, freshness and false-positive impact before enforcement. D:The other scenario states that an organization collects perimeter firewall logs but never observes outbound traffic from servers, where outbound signals can reveal exfiltration or command-and-control missed at ingress; by contrast, the present case requires validate intelligence relevance, freshness and false-positive impact before enforcement.
Question 317 A virtual machine fleet drifts from hardened images because teams make unmanaged console changes. What should operations implement? Use approved configuration baselines with automated drift detection and remediation governance Enforce versioned, attributable change tracking and approval for rule updates Activate documented incident authority, severity criteria and coordinated response roles Restore from an integrity-checked, approved and versioned configuration baseline Explanation Correct Answer A:Baseline comparison exposes unauthorized state changes and supports repeatable corrections. Incorrect Answers B:Configuration automation requires accountability and rollback, not just speed; it is relevant where an automation tool changes production firewall rules without change records, whereas the current facts require use approved configuration baselines with automated drift detection and remediation governance to address the stated problem. C:Clear activation and command reduce delay and conflicting action during disruption; although this helps when a ransomware event disrupts operations and executives disagree about whether an incident has been declared, it leaves the current case's need to use approved configuration baselines with automated drift detection and remediation governance unresolved. D:This option fits a different fact pattern where a disaster rebuild uses a configuration file from an unknown source: disaster recovery can reintroduce insecure settings if configuration provenance is ignored; the current case instead requires use approved configuration baselines with automated drift detection and remediation governance.
Question 318 An automation tool changes production firewall rules without change records. What configuration control is missing? Restore from an integrity-checked, approved and versioned configuration baseline Use approved configuration baselines with automated drift detection and remediation governance Enforce versioned, attributable change tracking and approval for rule updates Apply controlled storage, custody records and secure transport for protected media Explanation Correct Answer C:Configuration automation requires accountability and rollback, not just speed. Incorrect Answers A:For the separate situation in which a disaster rebuild uses a configuration file from an unknown source, disaster recovery can reintroduce insecure settings if configuration provenance is ignored; here the stated problem requires enforce versioned, attributable change tracking and approval for rule updates. B:Baseline comparison exposes unauthorized state changes and supports repeatable corrections; although this helps when a virtual machine fleet drifts from hardened images because teams make unmanaged console changes, it leaves the current case's need to enforce versioned, attributable change tracking and approval for rule updates unresolved. D:Physical media can expose entire systems independently of network perimeter controls; it is relevant where a data center stores sensitive backup tapes in unlocked cabinets awaiting shipment, whereas the current facts require enforce versioned, attributable change tracking and approval for rule updates to address the stated problem.
Question 319 A disaster rebuild uses a configuration file from an unknown source. What should be verified? Restore from an integrity-checked, approved and versioned configuration baseline Sanitize the media using a validated method suited to its sensitivity and technology Enforce versioned, attributable change tracking and approval for rule updates Use approved configuration baselines with automated drift detection and remediation governance Explanation Correct Answer A:Disaster recovery can reintroduce insecure settings if configuration provenance is ignored. Incorrect Answers B:Logical file deletion can leave recoverable data, especially across storage abstractions; although this helps when a retired workstation's disk is sold after files are deleted in the file manager, it leaves the current case's need to restore from an integrity-checked, approved and versioned configuration baseline unresolved. C:This option fits a different fact pattern where an automation tool changes production firewall rules without change records: configuration automation requires accountability and rollback, not just speed; the current case instead requires restore from an integrity-checked, approved and versioned configuration baseline. D:The other scenario states that a virtual machine fleet drifts from hardened images because teams make unmanaged console changes, where baseline comparison exposes unauthorized state changes and supports repeatable corrections; by contrast, the present case requires restore from an integrity-checked, approved and versioned configuration baseline.
Question 320 A service operator approves and deploys their own high-risk production changes without oversight. What foundational control is required? Define measurable SLA indicators, reporting boundaries and escalation for missed objectives Separate sensitive approvals from execution and maintain independent review Enforce versioned, attributable change tracking and approval for rule updates Reserve privileged identities for approved tasks and use standard accounts for routine work Explanation Correct Answer B:Separate approval authority from implementation for high-risk changes, preserving independent checks and traceable records so one operator cannot authorize and execute the same consequential action unilaterally. Incorrect Answers A:This option fits a different fact pattern where a business contract states 99.9% uptime but never defines measurement or penalties: a service level is useful only when obligations and measurement are unambiguous; the current case instead requires separate sensitive approvals from execution and maintain independent review. C:This option fits a different fact pattern where an automation tool changes production firewall rules without change records: configuration automation requires accountability and rollback, not just speed; the current case instead requires separate sensitive approvals from execution and maintain independent review. D:The other scenario states that a critical administration account is used for ordinary email and web browsing, where reducing high-privilege session exposure lowers compromise opportunities; by contrast, the present case requires separate sensitive approvals from execution and maintain independent review.
