Security Operations practice questions

Answer: A) Configuration management using a standardized secure baseline image

Building every server from one hardened, tested, version-controlled image is configuration management through a secure baseline. It makes secure settings consistent across all systems. Drift monitoring, vulnerability scanning and change approval are related controls, but none of them sets the baseline.

• ACorrect. Building every server from one tested, hardened, versioned image sets a secure configuration baseline and applies it the same way everywhere. This is the core aim of configuration management, and it removes the inconsistency of hand-built servers.
• BIncorrect. Drift monitoring compares running systems against a baseline after deployment. The scenario describes how the baseline is defined and applied at build time, not how changes are detected later.
• CIncorrect. Scanning finds weaknesses in systems that are already deployed. It does not produce or enforce a consistent hardened configuration.
• DIncorrect. Change management governs approval of changes. The scenario is about producing a standard, repeatable, hardened configuration, not about approving each build one at a time.

Answer: B) Putting the customer list in a password-protected .zip archive before attaching or copying it

DLP content inspection works only on content it can read. Encrypted or password-protected archives hide the data, so organizations add rules that act on files that can't be scanned.

• ADLP inspects message bodies as well as attachments, so sensitive information types in plain text in the body are matched and the message can be blocked.
• BDLP can't read inside a password-protected archive, so content rules never see the sensitive data. That's why DLP products offer conditions such as 'Attachment is password protected' or 'Document could not be scanned'. They let you audit or block files that can't be inspected.
• CEndpoint DLP inspects files on managed devices and can audit or block copying sensitive items to removable USB storage, so this channel is covered.
• DInline web and endpoint DLP inspect uploads made through the managed browser to cloud apps, so the document's contents would be evaluated against the policy.

Answer: A) It must be relevant to the case, reliable with integrity and chain of custody shown, and lawfully obtained

Admissible evidence must be relevant, reliable (integrity preserved and chain of custody documented) and legally obtained. Sound forensic handling such as hashing, immutable storage and logged custody supports reliability.

• ACorrect. Courts generally require evidence to be relevant, reliable/authentic and legally obtained. Write blockers, hash values, immutable storage and a documented chain of custody show that the evidence is reliable and unaltered. Proper legal authority shows it was lawfully obtained.
• BIncorrect. Relevance matters, but no specific examiner certification is required for admissibility. Forensic copies such as hash-verified images or snapshots are routinely used in place of the original media.
• CIncorrect. Hash values help show integrity, but digital evidence doesn't need an eyewitness to the event to be admissible. Its authenticity is shown through documented handling and integrity controls.
• DIncorrect. Lawful acquisition matters, but there is no general collection deadline for admissibility, and digital evidence doesn't have to be converted to paper.

Answer: A) A civil investigation; the standard of proof is a preponderance of the evidence (more likely than not)

• ACivil actions between parties seek remedies like damages and use the 'preponderance' standard. Criminal cases (state vs defendant) require proof 'beyond a reasonable doubt'; administrative/regulatory matters often use 'substantial evidence'.
• BThe scenario says the company is pursuing damages, not criminal charges; that's a civil matter.
• CNo regulator is described; this is a dispute between the employer and the employee.
• DOrganizations conduct their own administrative and civil investigations; law enforcement is needed for criminal proceedings.

Answer: A) Logging privileged sessions and having an independent party review them regularly

Preventive controls such as MFA, vaulting and least privilege cannot stop an authorized administrator from misusing legitimate access. Logging and independent review of privileged activity provide the detection and accountability needed against insider abuse.

• ACorrect. The admin is authorized and holds valid credentials, so preventive access controls won't stop the abuse. Independent review of logged privileged actions deters misuse, detects it and enforces accountability.
• BIncorrect. MFA protects against stolen or guessed credentials. A legitimate administrator who wants to abuse access can complete MFA with no trouble.
• CIncorrect. Vaulting and rotation limit credential theft and reuse. They do nothing to detect or deter an authorized admin misusing a session they checked out properly.
• DIncorrect. Fewer admins shrinks the attack surface, and least privilege is already in place. Any remaining authorized admin could still misuse access without being noticed.

Answer: A) Recovery: restore affected systems to a known safe state and monitor them so the threat does not return

After containment and eradication, the next phase is recovery: restoring systems to a known safe state and monitoring them for recurrence. Post-incident activity (lessons learned) follows before the incident is closed.

• ACorrect. Cutting off the attacker's access is containment, and removing the malware is eradication. Next comes recovery, which restores systems to a known safe state and monitors them to confirm the threat does not return. Post-incident activity (lessons learned) follows, before the incident is closed.
• BIncorrect. Containment already happened when the attacker's access was cut off. Repeating it is not the next step after eradication.
• CIncorrect. Analysis comes before containment and eradication. Teams may return to it to check whether their actions worked, but it is not the phase that moves systems back to normal operation.
• DIncorrect. Preparation takes place before an incident occurs. Improving preparedness from what was learned belongs to post-incident activity after recovery, not to the step right after eradication.

Answer: A) A deterrent control (it discourages a would-be intruder), which also supports later prosecution by removing an expectation of privacy

• AWarning banners primarily deter by signaling monitoring and consequences; legally they help establish that access was unauthorized and that the user had no reasonable expectation of privacy. They don't technically prevent access.
• BThe banner itself blocks nothing; authentication and authorization are the preventive controls.
• CCorrective controls act after the fact to fix damage; a banner is shown up front.
• DRecovery controls (backups, failover) restore operations; a banner has no recovery function.

Answer: A) Process it as an emergency change approved by the designated emergency approval body, then document and review it

Urgent security fixes go through the emergency change process: a smaller emergency body approves them quickly, and they are still documented and reviewed afterward. This balances speed with accountability.

• ACorrect. Emergency changes deal with urgent security threats and vulnerabilities. They still follow a documented procedure, but approval comes from a smaller emergency body (an ECAB), and records and a post-implementation review keep accountability.
• BIncorrect. Standard changes are low-risk, well-understood routine changes that are pre-approved. An urgent fix to a production server with an unknown outcome does not fit that category.
• CIncorrect. A normal change does go through full review, but waiting nine days leaves an actively exploited system exposed. The emergency process exists for exactly this situation.
• DIncorrect. A firewall rule can reduce risk for a short time, but a firewall rule is itself a change that needs control. Delaying the vendor fix for an actively exploited vulnerability is not the best response when an emergency change process is available.

Answer: A) A read-through (checklist) test

• AA read-through test has team members review the plan independently for accuracy.
• BA full interruption test actually shuts down primary operations.
• CA parallel test runs the recovery site alongside production.
• DA simulation acts out a scenario in more depth than a document review.

Answer: A) Define backup channels, such as SMS alerts and a call tree to personal phones, and train staff on them in advance

DR communication plans need backup channels that are independent of the infrastructure likely to fail, and staff should be trained on them before a disruption. Intranet, email and VoIP hosted in the lost site cannot be relied on.

• AA DR communication plan should set up primary and backup methods, such as email and SMS. Backup channels that don't rely on the failed facility, set up and practiced beforehand, still reach staff when normal channels are down.
• BThe intranet is hosted in the same primary data center, so it would probably be unavailable during this event.
• CPre-approved templates are good practice, but email depends on the failed data center. Staff would not receive these messages.
• DA clear chain of command is useful, but the VoIP desk phones also depend on the lost data center, so the relay would fail.