Security Policies and Procedures (15%)

200-201 · 45 questions

• At a hospital, a clinical device is live on the network and does not appear in the inventory the SOC uses. Which management practice failed?
• An agency incident plan names who may speak to the public, who may isolate a system, and how leadership is notified. Which plan elements are those three statements?
• At a bank, a server's running configuration no longer matches the approved baseline, and no change ticket exists for the difference. Which practice addresses this gap?
• At a retailer, store phones can be locked and wiped when people leave the company, and personal laptops cannot be controlled that way. Which practice covers the phones?
• A university team finds missing patches, weak service settings, and exposed admin pages, then ranks the findings and tracks them to closure. Which practice is that full effort?
• A manufacturer pushes vendor fixes to plant systems on a fixed schedule and does not rank configuration flaws or other weaknesses. Which practice is that schedule performing?
• A bank incident plan states which kinds of events count as incidents and which systems the plan covers. Which element of the plan is that statement?
• At a university, an alert is still unverified and the only fact in hand is a single failed logon on one lab PC. What handling step fits the evidence so far?
• A hospital incident-response plan shows a cover logo and contains neither a contact list nor a severity guide. What is missing for NIST-style incident-response preparation?
• A retailer has confirmed a beacon on a register that is still attached to the store LAN, and the incident plan says to isolate a confirmed host before imaging it. What is the next handling step?
• At a manufacturer, the infected host is already isolated, the malware has been removed, and the production line is still down. What phase work remains?
• A hotel guest Wi-Fi controller looks compromised, and that controller holds the only copy of the day's logs. What should the team protect while containing the device?
• A hospital SOC is still deciding whether a backup alert is an incident and is pulling related logs to make that decision. Which handling phase is underway?
• At a retailer, the team removes the malware, resets the passwords it used, and restores each register from a known-good image. Which incident-handling phase covers that work?
• Two weeks after an agency restores service, the team rewrites a detection that missed the forwarding rule used in the incident. Which incident-handling phase is that rewrite?
• Bank analysts build a contact tree and a severity chart before any incident has occurred this year. Which incident-handling phase is that work?
• A logistics hub finished restoring warehouse systems yesterday and confirmed that operations are back to normal. What does the incident-handling process still require?
• Before any incident at a bank, someone must write the incident plan, the contact tree, and the severity guide. Whose stakeholder role owns that preparation work?
• At a manufacturer, a production line must be isolated now and restarted later. Besides the SOC, who has to take part in containment and recovery for that line?
• At an agency, a laptop is still powered on and the suspect process is resident in memory. What should be collected before that laptop is shut down?
• A bank forensic analyst images a seized workstation disk and records one hash of the original disk and one hash of the image. Why are the two hashes recorded?
• At a hospital, after the incident is over, leadership and the people who responded meet to change the handling plan. Which phase are those stakeholders serving in that meeting?
• A university forensics lab stores the original laptop drive on a shelf and allows the analyst to work only from a forensic copy. Which practice does that shelf rule follow?
• An MSSP customer asks who performs detection and analysis on Tuesday night, when the customer's alerts need a person to review them. Which role does that work?
• A hotel reservations server is still running, its memory matters to the case, and the plan lists unplugging the server, copying memory, and hashing a disk image. Which action should happen first?
• At a bank, branch sessions normally last a few minutes, the critical-asset address list is unchanged, and one session to an uncommon address stays up the entire business day. Which network-profile element broke?
• At a retailer, stores normally reach the payment service on port 443, and one register starts a session on a rare high port toward a new address. Which network-profile element changed?
• At a logistics hub, the site profile records how much data normally crosses the WAN during an hour of warehouse work. Which network-profile element is that measurement?
• At a retailer, a manager powers off a point-of-sale register before anyone captures its memory. What does that power-off destroy?
• At a hospital, the network profile lists address ranges reserved for medical devices and says those ranges must not be used by general user endpoints, yet a laptop is using one of those addresses. Which profile element makes this matter?
• At a hospital, a file contains a patient's diagnosis together with that patient's medical-record number. Which data class does the file fall under?
• At a bank, a spreadsheet lists customer names and account numbers and contains no passwords. Which data class fits that spreadsheet?
• At an agency, a new process whose name looks like a remote shell is running beside the usual web process on a server. Which server-profile element is this?
• At a manufacturer, a server that should listen only on port 443 also starts listening on port 4444. Which server-profile element changed?
• At a university, a service account has an interactive session on a research server where that account has never logged on, and the listening ports are unchanged. Which server-profile element changed?
• At a hotel, a scheduled task has appeared on the reservation server and is absent from the approved task list. Which server-profile element does that new task belong to?
• At a retailer, a file contains cashier usernames and passwords for the register system. Which data class does that file fall under?
• A manufacturer folder holds unreleased product designs that are not about a person and are not passwords. Which data class fits that folder?
• A retailer mailbox has received a weaponized document, and nobody has opened the file. Which Lockheed Kill Chain phase describes this point?
• Malware is already on an agency host, it calls out for tasks, and it has not yet copied files. Which Lockheed Kill Chain phase fits this activity?
• A crew is researching employee names and a bank VPN address, and no malware has been sent. Which Lockheed Kill Chain phase fits this activity?
• An MSSP writes up a customer intrusion with four labels: the adversary, a malware capability, rented infrastructure, and the customer as the victim. Which model is that write-up using?
• At a logistics hub, analysts acknowledged the alert quickly and isolated the host quickly, yet the warehouse system stayed unusable until the next day. Acknowledgment is the response clock and isolation is already done. Which metric covers the last wait until operations were under control?
• At a bank, detection of a malicious host was fast, yet that host stayed on the network for a long time after the alert before anyone isolated it. Which metric explains the extra risk that the activity kept spreading?
• At a hospital, a beacon had been calling out for 20 days before the first alert, and nobody has isolated the host. That gap is observed for this case and is not a published target. Which SOC metric is long, and what does that length do to the investigation?