Question 330 Several incidents recur through the same neglected control gap. What should happen after recovery? Preserve evidence and coordinate containment under the authorized incident process Evaluate legal, contractual and stakeholder reporting obligations with authorized teams Activate documented incident authority, severity criteria and coordinated response roles Conduct lessons-learned analysis and assign verified corrective actions with owners Explanation Correct Answer D:Incident response includes systemic improvement, not only restoring today's service. Incorrect Answers A:This option fits a different fact pattern where the SOC confirms suspicious account access and wants to immediately delete every log to prevent panic: destroying telemetry undermines investigation and can breach reporting obligations; the current case instead requires conduct lessons-learned analysis and assign verified corrective actions with owners. B:This option fits a different fact pattern where a security incident is technically resolved but regulators may require notification: remediation does not eliminate notification or recordkeeping requirements; the current case instead requires conduct lessons-learned analysis and assign verified corrective actions with owners. C:Clear activation and command reduce delay and conflicting action during disruption; it is relevant where a ransomware event disrupts operations and executives disagree about whether an incident has been declared, whereas the current facts require conduct lessons-learned analysis and assign verified corrective actions with owners to address the stated problem.
Question 331 A network team runs IDS signatures but no control can stop a confirmed exploit in progress. What capability should be evaluated? Isolate malicious-file analysis in a controlled sandbox environment Apply risk-appropriate application allowlisting with controlled exception handling Use a properly tuned prevention control with safe enforcement and escalation Validate outputs, monitor drift and tune detection thresholds with human oversight Explanation Correct Answer C:Detection-only monitoring does not automatically block attack traffic. Incorrect Answers A:The other scenario states that a SOC sandbox automatically opens suspicious attachments on a production laptop, where dynamic detonation must not expose production endpoints to the payload being inspected; by contrast, the present case requires use a properly tuned prevention control with safe enforcement and escalation. B:The other scenario states that a company uses a denylist of known malicious programs but employees run unapproved tools, where allowlisting enforces approved execution rather than relying only on known-bad signatures; by contrast, the present case requires use a properly tuned prevention control with safe enforcement and escalation. D:The other scenario states that an AI detector labels legitimate customer behavior malicious during a holiday surge, where machine-learning alerts are probabilistic and sensitive to changing workloads; by contrast, the present case requires use a properly tuned prevention control with safe enforcement and escalation.
Question 332 A company uses a denylist of known malicious programs but employees run unapproved tools. What protection may help? Validate outputs, monitor drift and tune detection thresholds with human oversight Increase validated recovery-point frequency or replication to meet the business RPO Apply risk-appropriate application allowlisting with controlled exception handling Isolate malicious-file analysis in a controlled sandbox environment Explanation Correct Answer C:Allowlisting enforces approved execution rather than relying only on known-bad signatures. Incorrect Answers A:The other scenario states that an AI detector labels legitimate customer behavior malicious during a holiday surge, where machine-learning alerts are probabilistic and sensitive to changing workloads; by contrast, the present case requires apply risk-appropriate application allowlisting with controlled exception handling. B:The other scenario states that an application meets uptime requirements but its recovery data can lose 36 hours despite a one-hour RPO, where availability targets do not guarantee sufficiently recent recoverable state; by contrast, the present case requires apply risk-appropriate application allowlisting with controlled exception handling. D:The other scenario states that a SOC sandbox automatically opens suspicious attachments on a production laptop, where dynamic detonation must not expose production endpoints to the payload being inspected; by contrast, the present case requires apply risk-appropriate application allowlisting with controlled exception handling.
Question 333 A SOC sandbox automatically opens suspicious attachments on a production laptop. What should change? Validate outputs, monitor drift and tune detection thresholds with human oversight Isolate malicious-file analysis in a controlled sandbox environment Sanitize the media using a validated method suited to its sensitivity and technology Use a properly tuned prevention control with safe enforcement and escalation Explanation Correct Answer B:Dynamic detonation must not expose production endpoints to the payload being inspected. Incorrect Answers A:For the separate situation in which an AI detector labels legitimate customer behavior malicious during a holiday surge, machine-learning alerts are probabilistic and sensitive to changing workloads; here the stated problem requires isolate malicious-file analysis in a controlled sandbox environment. C:Logical file deletion can leave recoverable data, especially across storage abstractions; although this helps when a retired workstation's disk is sold after files are deleted in the file manager, it leaves the current case's need to isolate malicious-file analysis in a controlled sandbox environment unresolved. D:The other scenario states that a network team runs IDS signatures but no control can stop a confirmed exploit in progress, where detection-only monitoring does not automatically block attack traffic; by contrast, the present case requires isolate malicious-file analysis in a controlled sandbox environment.
Question 334 An AI detector labels legitimate customer behavior malicious during a holiday surge. What should operations do? Apply risk-appropriate application allowlisting with controlled exception handling Isolate malicious-file analysis in a controlled sandbox environment Tune the rule using validated context and false-positive evidence while preserving important coverage Validate outputs, monitor drift and tune detection thresholds with human oversight Explanation Correct Answer D:Machine-learning alerts are probabilistic and sensitive to changing workloads. Incorrect Answers A:This option fits a different fact pattern where a company uses a denylist of known malicious programs but employees run unapproved tools: allowlisting enforces approved execution rather than relying only on known-bad signatures; the current case instead requires validate outputs, monitor drift and tune detection thresholds with human oversight. B:The other scenario states that a SOC sandbox automatically opens suspicious attachments on a production laptop, where dynamic detonation must not expose production endpoints to the payload being inspected; by contrast, the present case requires validate outputs, monitor drift and tune detection thresholds with human oversight. C:For the separate situation in which a SIEM rule fires thousands of times on harmless administrative activity, excessive noise lowers response effectiveness and can hide real incidents; here the stated problem requires validate outputs, monitor drift and tune detection thresholds with human oversight.
Question 335 A hospital's critical vulnerability affects an Internet-facing authentication gateway, but patching is deferred without controls. What should operations do? Verify effective patch state through independent inventory and exception follow-up Prioritize validated exposure, implement temporary mitigation and schedule an approved patch Confirm the asset's exposure and remove unnecessary connectivity or decommission it Document risk, isolate access and agree on a supported remediation or replacement plan Explanation Correct Answer B:Risk-based remediation considers exploitability and service criticality, not a fixed calendar alone. Incorrect Answers A:Install job success is not proof that all endpoints reached the required version; it is relevant where a desktop patch deployment reports 100% success but several systems still run the vulnerable version, whereas the current facts require prioritize validated exposure, implement temporary mitigation and schedule an approved patch to address the stated problem. C:Risk treatment may be faster and more effective than patching an obsolete asset; although this helps when a scanner finds a vulnerability in a retired asset still connected to production, it leaves the current case's need to prioritize validated exposure, implement temporary mitigation and schedule an approved patch unresolved. D:This option fits a different fact pattern where a legacy controller cannot be patched because vendor certification would be voided: unsupported patching can create safety risks; compensating controls require accountable acceptance; the current case instead requires prioritize validated exposure, implement temporary mitigation and schedule an approved patch.
Question 336 A desktop patch deployment reports 100% success but several systems still run the vulnerable version. What should be corrected? Assess impact, authorize the change and prepare tested rollback before deployment Document risk, isolate access and agree on a supported remediation or replacement plan Verify effective patch state through independent inventory and exception follow-up Confirm the asset's exposure and remove unnecessary connectivity or decommission it Explanation Correct Answer C:Install job success is not proof that all endpoints reached the required version. Incorrect Answers A:The other scenario states that a firewall modification is applied on Friday with no rollback plan and breaks payroll, where approved risk and recovery arrangements reduce business disruption from security changes; by contrast, the present case requires verify effective patch state through independent inventory and exception follow-up. B:The other scenario states that a legacy controller cannot be patched because vendor certification would be voided, where unsupported patching can create safety risks; compensating controls require accountable acceptance; by contrast, the present case requires verify effective patch state through independent inventory and exception follow-up. D:Risk treatment may be faster and more effective than patching an obsolete asset; this responds to the different circumstance in which a scanner finds a vulnerability in a retired asset still connected to production, while the current case states that a desktop patch deployment reports 100% success but several systems still run the vulnerable version, calling for verify effective patch state through independent inventory and exception follow-up.
Question 337 A legacy controller cannot be patched because vendor certification would be voided. What process is appropriate? Select and test a recovery arrangement with pre-provisioned capacity that meets the RTO Verify effective patch state through independent inventory and exception follow-up Confirm the asset's exposure and remove unnecessary connectivity or decommission it Document risk, isolate access and agree on a supported remediation or replacement plan Explanation Correct Answer D:Unsupported patching can create safety risks; compensating controls require accountable acceptance. Incorrect Answers A:Cold-site facilities alone cannot support stringent restart times without ready resources; this responds to the different circumstance in which a recovery site has space and power but cannot meet a 30-minute restoration objective because compute must be purchased afterward, while the current case states that a legacy controller cannot be patched because vendor certification would be voided, calling for document risk, isolate access and agree on a supported remediation or replacement plan. B:The other scenario states that a desktop patch deployment reports 100% success but several systems still run the vulnerable version, where install job success is not proof that all endpoints reached the required version; by contrast, the present case requires document risk, isolate access and agree on a supported remediation or replacement plan. C:Risk treatment may be faster and more effective than patching an obsolete asset; it is relevant where a scanner finds a vulnerability in a retired asset still connected to production, whereas the current facts require document risk, isolate access and agree on a supported remediation or replacement plan to address the stated problem.
Question 338 A scanner finds a vulnerability in a retired asset still connected to production. What should triage prioritize? Confirm the asset's exposure and remove unnecessary connectivity or decommission it Prioritize validated exposure, implement temporary mitigation and schedule an approved patch Document risk, isolate access and agree on a supported remediation or replacement plan Maintain suitably protected copies in a geographically and operationally separate failure domain Explanation Correct Answer A:Risk treatment may be faster and more effective than patching an obsolete asset. Incorrect Answers B:For the separate situation in which a hospital's critical vulnerability affects an Internet-facing authentication gateway, but patching is deferred without controls, risk-based remediation considers exploitability and service criticality, not a fixed calendar alone; here the stated problem requires confirm the asset's exposure and remove unnecessary connectivity or decommission it. C:For the separate situation in which a legacy controller cannot be patched because vendor certification would be voided, unsupported patching can create safety risks; compensating controls require accountable acceptance; here the stated problem requires confirm the asset's exposure and remove unnecessary connectivity or decommission it. D:The other scenario states that a company keeps only backups within the same building as its production systems, where one-site disasters can destroy primary data and all local recovery copies; by contrast, the present case requires confirm the asset's exposure and remove unnecessary connectivity or decommission it.
Question 339 A firewall modification is applied on Friday with no rollback plan and breaks payroll. What should change management require? Document risk, isolate access and agree on a supported remediation or replacement plan Assess impact, authorize the change and prepare tested rollback before deployment Use an expedited documented emergency change path with later independent review Coordinate configuration and release impact assessment across affected stakeholders Explanation Correct Answer B:Approved risk and recovery arrangements reduce business disruption from security changes. Incorrect Answers A:For the separate situation in which a legacy controller cannot be patched because vendor certification would be voided, unsupported patching can create safety risks; compensating controls require accountable acceptance; here the stated problem requires assess impact, authorize the change and prepare tested rollback before deployment. C:Urgency justifies faster authorization, not abandonment of accountability; this responds to the different circumstance in which an emergency patch must be installed immediately to contain active exploitation, while the current case states that a firewall modification is applied on Friday with no rollback plan and breaks payroll, calling for assess impact, authorize the change and prepare tested rollback before deployment. D:Changes to shared dependencies need review beyond the team deploying the update; although this helps when a third-party update modifies authentication dependencies without notifying application owners, it leaves the current case's need to assess impact, authorize the change and prepare tested rollback before deployment unresolved.
Question 340 An emergency patch must be installed immediately to contain active exploitation. How should governance accommodate it? Assess impact, authorize the change and prepare tested rollback before deployment Coordinate configuration and release impact assessment across affected stakeholders Use an expedited documented emergency change path with later independent review Include critical suppliers and alternative logistics arrangements in BC scenario testing Explanation Correct Answer C:Urgency justifies faster authorization, not abandonment of accountability. Incorrect Answers A:The other scenario states that a firewall modification is applied on Friday with no rollback plan and breaks payroll, where approved risk and recovery arrangements reduce business disruption from security changes; by contrast, the present case requires use an expedited documented emergency change path with later independent review. B:Changes to shared dependencies need review beyond the team deploying the update; this responds to the different circumstance in which a third-party update modifies authentication dependencies without notifying application owners, while the current case states that an emergency patch must be installed immediately to contain active exploitation, calling for use an expedited documented emergency change path with later independent review. D:This option fits a different fact pattern where a distribution business relies on a single external warehouse that never joins continuity exercises: external dependencies can stop business operations despite successful internal recovery; the current case instead requires use an expedited documented emergency change path with later independent review.
