Read each question and choose an answer before opening its explanation. The rationale explains why the keyed response best meets the scenario and why attractive alternatives fall short.
Question 1·Objective 7.1: Investigations, evidence, reporting, forensic methods/tools, and host/network/mobile artifacts
An examiner must acquire a forensic image from a powered-off drive that may contain evidence. Which practice BEST demonstrates that the acquired image accurately represents the source without altering it?
- A.Mount the source read-write and compare filenames visually
- B.Use a write blocker and verify cryptographic hashes of the source acquisition and image
- C.Copy only files whose names appear suspicious
- D.Compress the source before calculating any integrity value
Show answer and explanation
Best answer: B. Use a write blocker and verify cryptographic hashes of the source acquisition and image
A write blocker protects the source from modification, and cryptographic hash verification documents integrity of the acquisition and resulting image.
A: Read-write mounting can alter evidence and visual comparison is insufficient.
B: A write blocker protects the source from modification, and cryptographic hash verification documents integrity of the acquisition and resulting image.
C: Selective copying omits context and deleted or hidden artifacts.
D: Transforming data before establishing integrity weakens verification.
Question 2·Objective 7.10: Backups, recovery sites, multisite processing, resilience, availability, QoS, and fault tolerance
A payroll process has an approved recovery time objective of eight hours and a recovery point objective of fifteen minutes. Which design consideration is MOST directly driven by the fifteen-minute objective?
- A.How quickly replacement office space is occupied
- B.How frequently data is replicated or backed up
- C.How long the incident report remains open
- D.How many staff attend awareness training
Show answer and explanation
Best answer: B. How frequently data is replicated or backed up
RPO expresses tolerable data loss measured in time, so backup or replication frequency and recoverability must support no more than about fifteen minutes of lost data.
A: Facility occupancy relates more directly to recovery time and workspace strategy.
B: RPO expresses tolerable data loss measured in time, so backup or replication frequency and recoverability must support no more than about fifteen minutes of lost data.
C: Ticket duration is not data-loss tolerance.
D: Training attendance does not set recoverable data currency.
Question 3·Objective 7.12: DR tests: read-through/tabletop, walkthrough, simulation, parallel, full interruption, and communications
An organization wants to process a representative workload at its recovery site and compare results with production while leaving production services running. Which disaster-recovery test is MOST appropriate?
- A.Read-through
- B.Tabletop
- C.Parallel
- D.Full interruption
Show answer and explanation
Best answer: C. Parallel
A parallel test operates recovery capabilities alongside production and compares processing without deliberately stopping the primary environment.
A: A read-through reviews documentation rather than operating recovery processing.
B: A tabletop discusses a scenario without running the recovery environment at this level.
C: A parallel test operates recovery capabilities alongside production and compares processing without deliberately stopping the primary environment.
D: A full interruption stops or transfers production and creates much greater operational risk.
Question 4·Objective 7.2: IDPS, SIEM, continuous/egress/log monitoring, threat intelligence/hunting, and UEBA
A new SIEM rule generates thousands of alerts from a legitimate backup service, and analysts begin ignoring the queue. What should the SOC manager do FIRST?
- A.Disable all monitoring for the backup servers
- B.Validate the events and detection objective, then tune the rule using documented, narrowly scoped conditions
- C.Mark every alert as an incident
- D.Increase log retention without changing the rule
Show answer and explanation
Best answer: B. Validate the events and detection objective, then tune the rule using documented, narrowly scoped conditions
Validation prevents suppressing real malicious behavior; narrowly scoped, documented tuning then reduces noise while preserving the detection objective.
A: Broadly disabling monitoring creates a blind spot.
B: Validation prevents suppressing real malicious behavior; narrowly scoped, documented tuning then reduces noise while preserving the detection objective.
C: Treating known benign behavior as incidents worsens overload.
D: Retention does not improve alert precision.
Question 5·Objective 7.6: Incident detection, response, mitigation, reporting, recovery, remediation, and lessons learned
Endpoint monitoring confirms active ransomware encryption on one employee workstation. The extent of lateral movement is unknown, and the incident response plan authorizes remote network isolation. What should the incident commander do FIRST?
- A.Remotely isolate the affected workstation while preserving its state for investigation
- B.Power off every system in the employee's network segment
- C.Restore the workstation from its most recent backup
- D.Notify all customers that their information was exposed
Show answer and explanation
Best answer: A. Remotely isolate the affected workstation while preserving its state for investigation
Authorized isolation limits further communication and potential spread while preserving the workstation for analysis. It is a proportionate first containment action based on the confirmed evidence.
A: Authorized isolation limits further communication and potential spread while preserving the workstation for analysis. It is a proportionate first containment action based on the confirmed evidence.
B: Shutting down an entire segment may destroy volatile evidence and cause unnecessary business impact before the scope is known.
C: Recovery before containment and analysis can destroy evidence and allow reinfection or continued spread.
D: Notification decisions require confirmed scope, impact, and applicable obligations; exposure has not yet been established.
Question 6·Objective 7.1: Investigations, evidence, reporting, forensic methods/tools, and host/network/mobile artifacts
Investigators must acquire volatile evidence from a running compromised host. What should guide the sequence?
- A.Alphabetical file names
- B.Order of volatility and a documented forensic procedure
- C.The size of each disk partition
- D.Which evidence is easiest to explain
Show answer and explanation
Best answer: B. Order of volatility and a documented forensic procedure
Volatile evidence can disappear quickly, so acquisition order and integrity documentation matter.
A: This option may be relevant in another context, but it does not meet the stated control objective or priority.
B: Volatile evidence can disappear quickly, so acquisition order and integrity documentation matter.
C: This option may be relevant in another context, but it does not meet the stated control objective or priority.
D: This option may be relevant in another context, but it does not meet the stated control objective or priority.
Question 7·Objective 7.2: IDPS, SIEM, continuous/egress/log monitoring, threat intelligence/hunting, and UEBA
A SIEM rule produces a manageable but persistent number of alerts for a recurring business process. What is the BEST long-term improvement?
- A.Disable the rule permanently because it creates analyst work
- B.Suppress every alert from the business system without review
- C.Review the detection logic with process owners, tune it using validated context, and monitor the resulting false-positive rate
- D.Require analysts to close the alerts without documenting the cause
Show answer and explanation
Best answer: C. Review the detection logic with process owners, tune it using validated context, and monitor the resulting false-positive rate
This action directly addresses the stated operational security requirement while preserving appropriate evidence and accountability.
A: This option is less effective because it does not meet the stated operational requirement.
B: This option is less effective because it does not meet the stated operational requirement.
C: This action directly addresses the stated operational security requirement while preserving appropriate evidence and accountability.
D: This option is less effective because it does not meet the stated operational requirement.
Question 8·Objective 7.3: Configuration management, provisioning, baselines, and automation
Servers drift from approved configuration baselines. What is the BEST long-term control?
- A.Annual screenshots
- B.Shared root passwords
- C.Manual changes without records
- D.Automated configuration enforcement with approved exception handling
Show answer and explanation
Best answer: D. Automated configuration enforcement with approved exception handling
Automation and governed exceptions reduce and expose drift consistently.
A: This option may be relevant in another context, but it does not meet the stated control objective or priority.
B: This option may be relevant in another context, but it does not meet the stated control objective or priority.
C: This option may be relevant in another context, but it does not meet the stated control objective or priority.
D: Automation and governed exceptions reduce and expose drift consistently.
Question 9·Objective 7.4: Need-to-know, least privilege, separation of duties, privileged access, rotation, and SLAs
One administrator can request, approve, and execute emergency production access. What is the PRIMARY concern?
- A.Insufficient separation of duties
- B.Excessive encryption
- C.Too many recovery sites
- D.Weak media labeling
Show answer and explanation
Best answer: A. Insufficient separation of duties
Concentrating incompatible functions increases fraud and error risk.
A: Concentrating incompatible functions increases fraud and error risk.
B: This option may be relevant in another context, but it does not meet the stated control objective or priority.
C: This option may be relevant in another context, but it does not meet the stated control objective or priority.
D: This option may be relevant in another context, but it does not meet the stated control objective or priority.
Question 10·Objective 7.5: Media and data-in-transit/at-rest protection
Encrypted backup media is sent offsite. What additional control is MOST important?
- A.Remove all labels and records
- B.Track custody and verify recoverability and key availability
- C.Store encryption keys only with the media
- D.Assume encryption proves successful backups
Show answer and explanation
Best answer: B. Track custody and verify recoverability and key availability
Custody, restoration, and key continuity are necessary in addition to confidentiality.
A: This option may be relevant in another context, but it does not meet the stated control objective or priority.
B: Custody, restoration, and key continuity are necessary in addition to confidentiality.
C: This option may be relevant in another context, but it does not meet the stated control objective or priority.
D: This option may be relevant in another context, but it does not meet the stated control objective or priority.
Continue studying Security Operations
Review the complete Domain 7 guide, then mix this material with the other seven domains in an adaptive mock exam.