Question 320 A service operator approves and deploys their own high-risk production changes without oversight. What foundational control is required? Define measurable SLA indicators, reporting boundaries and escalation for missed objectives Separate sensitive approvals from execution and maintain independent review Enforce versioned, attributable change tracking and approval for rule updates Reserve privileged identities for approved tasks and use standard accounts for routine work Explanation Correct Answer B:Separate approval authority from implementation for high-risk changes, preserving independent checks and traceable records so one operator cannot authorize and execute the same consequential action unilaterally. Incorrect Answers A:This option fits a different fact pattern where a business contract states 99.9% uptime but never defines measurement or penalties: a service level is useful only when obligations and measurement are unambiguous; the current case instead requires separate sensitive approvals from execution and maintain independent review. C:This option fits a different fact pattern where an automation tool changes production firewall rules without change records: configuration automation requires accountability and rollback, not just speed; the current case instead requires separate sensitive approvals from execution and maintain independent review. D:The other scenario states that a critical administration account is used for ordinary email and web browsing, where reducing high-privilege session exposure lowers compromise opportunities; by contrast, the present case requires separate sensitive approvals from execution and maintain independent review.
Question 321 A critical administration account is used for ordinary email and web browsing. What should change? Confirm investigative authority, scope and privacy obligations before collecting personal data Reserve privileged identities for approved tasks and use standard accounts for routine work Define measurable SLA indicators, reporting boundaries and escalation for missed objectives Separate sensitive approvals from execution and maintain independent review Explanation Correct Answer B:Privileged identities should be reserved for authorized administrative tasks; browsing and routine email increase exposure to phishing and untrusted content and should use a separate standard account. Incorrect Answers A:Technical capability does not replace lawful permission to acquire evidence; although this helps when a manager asks investigators to search an employee's personal cloud account without legal authorization, it leaves the current case's need to reserve privileged identities for approved tasks and use standard accounts for routine work unresolved. C:A service level is useful only when obligations and measurement are unambiguous; although this helps when a business contract states 99.9% uptime but never defines measurement or penalties, it leaves the current case's need to reserve privileged identities for approved tasks and use standard accounts for routine work unresolved. D:The other scenario states that a service operator approves and deploys their own high-risk production changes without oversight, where separation of duties constrains unilateral high-impact actions; by contrast, the present case requires reserve privileged identities for approved tasks and use standard accounts for routine work.
Question 322 A business contract states 99.9% uptime but never defines measurement or penalties. What governance should improve? Add authorized egress monitoring and correlate traffic with asset and identity context Reserve privileged identities for approved tasks and use standard accounts for routine work Define measurable SLA indicators, reporting boundaries and escalation for missed objectives Separate sensitive approvals from execution and maintain independent review Explanation Correct Answer C:A service level is useful only when obligations and measurement are unambiguous. Incorrect Answers A:Outbound signals can reveal exfiltration or command-and-control missed at ingress; although this helps when an organization collects perimeter firewall logs but never observes outbound traffic from servers, it leaves the current case's need to define measurable SLA indicators, reporting boundaries and escalation for missed objectives unresolved. B:Reducing high-privilege session exposure lowers compromise opportunities; although this helps when a critical administration account is used for ordinary email and web browsing, it leaves the current case's need to define measurable SLA indicators, reporting boundaries and escalation for missed objectives unresolved. D:This option fits a different fact pattern where a service operator approves and deploys their own high-risk production changes without oversight: separation of duties constrains unilateral high-impact actions; the current case instead requires define measurable SLA indicators, reporting boundaries and escalation for missed objectives.
Question 323 A data center stores sensitive backup tapes in unlocked cabinets awaiting shipment. What should resource protection enforce? Apply controlled storage, custody records and secure transport for protected media Control, inventory and audit physical override credentials Protect data at rest with appropriate encryption and limited decryption access Sanitize the media using a validated method suited to its sensitivity and technology Explanation Correct Answer A:Physical media can expose entire systems independently of network perimeter controls. Incorrect Answers B:This option fits a different fact pattern where a data room has an electronic lock but mechanical emergency keys circulate without records: physical bypass mechanisms require custody just as electronic access does; the current case instead requires apply controlled storage, custody records and secure transport for protected media. C:For the separate situation in which an engineer uses TLS for transport but leaves archives unencrypted on a shared backup server, in-transit encryption does not safeguard stored copies or misuse by backup administrators; here the stated problem requires apply controlled storage, custody records and secure transport for protected media. D:Logical file deletion can leave recoverable data, especially across storage abstractions; it is relevant where a retired workstation's disk is sold after files are deleted in the file manager, whereas the current facts require apply controlled storage, custody records and secure transport for protected media to address the stated problem.
Question 324 A retired workstation's disk is sold after files are deleted in the file manager. What should be done first? Confirm the asset's exposure and remove unnecessary connectivity or decommission it Sanitize the media using a validated method suited to its sensitivity and technology Apply controlled storage, custody records and secure transport for protected media Protect data at rest with appropriate encryption and limited decryption access Explanation Correct Answer B:Logical file deletion can leave recoverable data, especially across storage abstractions. Incorrect Answers A:This option fits a different fact pattern where a scanner finds a vulnerability in a retired asset still connected to production: risk treatment may be faster and more effective than patching an obsolete asset; the current case instead requires sanitize the media using a validated method suited to its sensitivity and technology. C:The other scenario states that a data center stores sensitive backup tapes in unlocked cabinets awaiting shipment, where physical media can expose entire systems independently of network perimeter controls; by contrast, the present case requires sanitize the media using a validated method suited to its sensitivity and technology. D:In-transit encryption does not safeguard stored copies or misuse by backup administrators; it is relevant where an engineer uses TLS for transport but leaves archives unencrypted on a shared backup server, whereas the current facts require sanitize the media using a validated method suited to its sensitivity and technology to address the stated problem.
Question 325 An engineer uses TLS for transport but leaves archives unencrypted on a shared backup server. What gap remains? Apply risk-appropriate application allowlisting with controlled exception handling Protect data at rest with appropriate encryption and limited decryption access Apply controlled storage, custody records and secure transport for protected media Sanitize the media using a validated method suited to its sensitivity and technology Explanation Correct Answer B:In-transit encryption does not safeguard stored copies or misuse by backup administrators. Incorrect Answers A:For the separate situation in which a company uses a denylist of known malicious programs but employees run unapproved tools, allowlisting enforces approved execution rather than relying only on known-bad signatures; here the stated problem requires protect data at rest with appropriate encryption and limited decryption access. C:Physical media can expose entire systems independently of network perimeter controls; this responds to the different circumstance in which a data center stores sensitive backup tapes in unlocked cabinets awaiting shipment, while the current case states that an engineer uses TLS for transport but leaves archives unencrypted on a shared backup server, calling for protect data at rest with appropriate encryption and limited decryption access. D:This option fits a different fact pattern where a retired workstation's disk is sold after files are deleted in the file manager: logical file deletion can leave recoverable data, especially across storage abstractions; the current case instead requires protect data at rest with appropriate encryption and limited decryption access.
Question 326 The SOC confirms suspicious account access and wants to immediately delete every log to prevent panic. What is the correct early response? Preserve evidence and coordinate containment under the authorized incident process Apply risk-based containment with safety and service-impact coordination Activate documented incident authority, severity criteria and coordinated response roles Conduct lessons-learned analysis and assign verified corrective actions with owners Explanation Correct Answer A:Destroying telemetry undermines investigation and can breach reporting obligations. Incorrect Answers B:Containment decisions must account for critical business and human consequences; although this helps when an incident responder isolates every server without assessing operational dependencies, jeopardizing patient care, it leaves the current case's need to preserve evidence and coordinate containment under the authorized incident process unresolved. C:The other scenario states that a ransomware event disrupts operations and executives disagree about whether an incident has been declared, where clear activation and command reduce delay and conflicting action during disruption; by contrast, the present case requires preserve evidence and coordinate containment under the authorized incident process. D:Incident response includes systemic improvement, not only restoring today's service; although this helps when several incidents recur through the same neglected control gap, it leaves the current case's need to preserve evidence and coordinate containment under the authorized incident process unresolved.
Question 327 A ransomware event disrupts operations and executives disagree about whether an incident has been declared. What should governance establish? Activate documented incident authority, severity criteria and coordinated response roles Evaluate legal, contractual and stakeholder reporting obligations with authorized teams Apply risk-based containment with safety and service-impact coordination Preserve evidence and coordinate containment under the authorized incident process Explanation Correct Answer A:Clear activation and command reduce delay and conflicting action during disruption. Incorrect Answers B:Remediation does not eliminate notification or recordkeeping requirements; although this helps when a security incident is technically resolved but regulators may require notification, it leaves the current case's need to activate documented incident authority, severity criteria and coordinated response roles unresolved. C:This option fits a different fact pattern where an incident responder isolates every server without assessing operational dependencies, jeopardizing patient care: containment decisions must account for critical business and human consequences; the current case instead requires activate documented incident authority, severity criteria and coordinated response roles. D:The other scenario states that the SOC confirms suspicious account access and wants to immediately delete every log to prevent panic, where destroying telemetry undermines investigation and can breach reporting obligations; by contrast, the present case requires activate documented incident authority, severity criteria and coordinated response roles.
Question 328 An incident responder isolates every server without assessing operational dependencies, jeopardizing patient care. What should the commander do? Apply risk-based containment with safety and service-impact coordination Evaluate legal, contractual and stakeholder reporting obligations with authorized teams Conduct lessons-learned analysis and assign verified corrective actions with owners Activate documented incident authority, severity criteria and coordinated response roles Explanation Correct Answer A:Containment decisions must account for critical business and human consequences. Incorrect Answers B:This option fits a different fact pattern where a security incident is technically resolved but regulators may require notification: remediation does not eliminate notification or recordkeeping requirements; the current case instead requires apply risk-based containment with safety and service-impact coordination. C:Incident response includes systemic improvement, not only restoring today's service; this responds to the different circumstance in which several incidents recur through the same neglected control gap, while the current case states that an incident responder isolates every server without assessing operational dependencies, jeopardizing patient care, calling for apply risk-based containment with safety and service-impact coordination. D:This option fits a different fact pattern where a ransomware event disrupts operations and executives disagree about whether an incident has been declared: clear activation and command reduce delay and conflicting action during disruption; the current case instead requires apply risk-based containment with safety and service-impact coordination.
Question 329 A security incident is technically resolved but regulators may require notification. What must occur? Conduct lessons-learned analysis and assign verified corrective actions with owners Preserve evidence and coordinate containment under the authorized incident process Apply risk-based containment with safety and service-impact coordination Evaluate legal, contractual and stakeholder reporting obligations with authorized teams Explanation Correct Answer D:Remediation does not eliminate notification or recordkeeping requirements. Incorrect Answers A:This option fits a different fact pattern where several incidents recur through the same neglected control gap: incident response includes systemic improvement, not only restoring today's service; the current case instead requires evaluate legal, contractual and stakeholder reporting obligations with authorized teams. B:The other scenario states that the SOC confirms suspicious account access and wants to immediately delete every log to prevent panic, where destroying telemetry undermines investigation and can breach reporting obligations; by contrast, the present case requires evaluate legal, contractual and stakeholder reporting obligations with authorized teams. C:This option fits a different fact pattern where an incident responder isolates every server without assessing operational dependencies, jeopardizing patient care: containment decisions must account for critical business and human consequences; the current case instead requires evaluate legal, contractual and stakeholder reporting obligations with authorized teams.
Question 330 Several incidents recur through the same neglected control gap. What should happen after recovery? Preserve evidence and coordinate containment under the authorized incident process Evaluate legal, contractual and stakeholder reporting obligations with authorized teams Activate documented incident authority, severity criteria and coordinated response roles Conduct lessons-learned analysis and assign verified corrective actions with owners Explanation Correct Answer D:Incident response includes systemic improvement, not only restoring today's service. Incorrect Answers A:This option fits a different fact pattern where the SOC confirms suspicious account access and wants to immediately delete every log to prevent panic: destroying telemetry undermines investigation and can breach reporting obligations; the current case instead requires conduct lessons-learned analysis and assign verified corrective actions with owners. B:This option fits a different fact pattern where a security incident is technically resolved but regulators may require notification: remediation does not eliminate notification or recordkeeping requirements; the current case instead requires conduct lessons-learned analysis and assign verified corrective actions with owners. C:Clear activation and command reduce delay and conflicting action during disruption; it is relevant where a ransomware event disrupts operations and executives disagree about whether an incident has been declared, whereas the current facts require conduct lessons-learned analysis and assign verified corrective actions with owners to address the stated problem.
