Security Operations

In an incident response plan, which metric is most useful for measuring the 'dwell time' of a threat actor?

Which document is considered the primary 'source of truth' for defining the SOC's roles, responsibilities, and communication paths during a major security incident?

When using Palo Alto Networks Cortex XSOAR, which component is responsible for orchestrating the execution of scripts across multiple third-party integrations?

An organization is investigating a potential lateral movement incident in AWS. Which CloudTrail event field provides the most reliable indicator of the source IP address for an API call performed by an IAM role?

When configuring CrowdStrike Falcon to isolate a host during an active incident, what is the prerequisite requirement for the agent's communication state?

In Tenable.io, when prioritizing vulnerability remediation, which metric provides the best insight into the likelihood of a vulnerability being exploited in the wild?

In Splunk Enterprise Security, which dashboard should the SOC manager review to evaluate the effectiveness of the current correlation searches and the volume of notable events?

Which phase of the NIST Incident Response Life Cycle involves activities like system sanitization and validation of system integrity?

In Okta, to restrict administrative access to a specific geographic region during an active session, which policy should be modified?

Which SOC metric is most appropriate to present to executive leadership to demonstrate the business value of security investments?

Which component in the MITRE ATT&CK framework should be mapped to an SOC alerting rule to ensure the alert covers a specific adversary objective?

When managing a FortiGate firewall, which feature allows the SOC to dynamically update network objects based on external threat feeds?

A Microsoft Entra ID (Azure AD) user account is suspected of compromise. What is the most effective way to invalidate all active session tokens immediately?

In Rapid7 InsightVM, what is the best way to categorize assets into groups based on their business function for targeted vulnerability reporting?

When implementing FIM (File Integrity Monitoring) in Tripwire Enterprise, what is the specific purpose of a 'Promotion' action?

In the context of the Google Cloud Security Command Center (SCC), which feature provides a prioritized list of findings based on the criticality of the impacted asset?

During an incident, which document is used by the SOC to record evidence, timestamps, and actions taken to ensure admissibility in a legal proceeding?

Which SOC process ensures that all security tools are configured to log at the same time standard to prevent confusion during timeline analysis?

When configuring a Qualys scanner to perform authenticated scans on Windows, what is the 'Windows Authentication Record' primarily used for?

Which document describes the specific steps an analyst should take when a 'Phishing' alert is triggered in the SIEM?

Which TWO of the following are primary components of an effective Incident Response (IR) program?

Which TWO metrics are essential for evaluating the performance of a SOC team in identifying and containing threats?

Which THREE actions should be taken when performing an incident post-mortem according to industry best practices?

Which THREE factors are required to calculate the 'Risk' of a vulnerability for reporting purposes?

Which THREE pieces of information should be included in an 'Incident Notification' for executive stakeholders?

Which TWO communication channels are typically used for emergency incident coordination within a SOC?

Which THREE types of data should be ingested by a SIEM to improve its threat detection capabilities?

Which TWO of the following are considered 'Indicator of Compromise' (IOC) types?

Which THREE technical controls are effective for limiting the impact of lateral movement?

Which THREE activities are included in the 'Preparation' phase of the IR life cycle?

A security manager at a mid-sized financial firm discovers that a privileged database administrator account was used at 02:00 UTC to export 40 GB of customer records to an external IP address. The account was not locked out, no alert fired, and the export completed over 47 minutes. Which action should the manager take FIRST to align with the ISC2 ISSMP incident management lifecycle?

A healthcare organization is building a Security Operations Center and must define how it will measure and govern detection and response performance. The CISO asks the security manager to select metrics that directly reflect the SOC's ability to detect and respond to threats. Which TWO metrics best meet this requirement? (Choose two.)

A security manager is drafting the business continuity plan for a payment processing platform. The CIO asks which element establishes the maximum tolerable time that the payment service can be unavailable before the organization suffers unacceptable financial and regulatory harm. Which concept should the manager document?

During a declared major incident, the incident commander needs to preserve volatile evidence on a compromised Linux server before the platform team rebuilds it. The server hosts a critical billing application and cannot be taken offline for more than 30 minutes. Which action BEST satisfies both the evidentiary requirement and the availability constraint?

A security manager is reviewing the organization's log management program. An auditor notes that several critical servers retain logs for only 7 days, while the incident response policy requires the ability to investigate incidents up to 90 days after detection. The servers generate approximately 50 GB of logs per day. Which action BEST addresses the audit finding while controlling storage cost?

A security manager is building the incident response program for a financial services firm and needs to define the criteria that determine when an event must be escalated to a formally declared incident. Which artifact should be created to document these criteria, the required responders, and the approval chain for escalation?

A security operations manager is reviewing the SOC's use of threat intelligence and wants to ensure that indicators are automatically ingested and matched against event data with minimal latency. Which capability should be prioritized to meet this objective?

A security manager is establishing a formal incident response capability and wants to ensure that lessons learned from major incidents are captured and used to improve future response. Which activity should be conducted after a significant incident to meet this goal?

A security manager is leading the response to a confirmed ransomware outbreak on a file server. The malware is still actively encrypting files and spreading laterally via SMB. Executive leadership asks the manager to authorize immediate containment. Which action BEST satisfies the containment objective while preserving forensic evidence?

A security manager is defining the scope of the organization's incident response program and needs to ensure that the program addresses all phases of the incident handling lifecycle. Which sequence of phases should the manager use as the framework for the program?

A security operations manager is designing a threat intelligence program to improve detection of advanced persistent threats (APTs). The organization wants to prioritize intelligence that is actionable and relevant. Which TWO characteristics of threat intelligence are MOST important for driving effective detection engineering? (Choose two.)

A security manager is reviewing the organization's incident response plan and wants to ensure that evidence collected during an incident is handled in a manner that preserves its integrity for potential legal proceedings. Which TWO practices should be included in the evidence handling procedures? (Choose two.)

A security manager is reviewing the organization's incident response plan. The plan requires that after a major incident, lessons learned are captured and used to improve future response. Which activity BEST ensures that lessons learned are effectively integrated into the security operations program?

A security manager is evaluating the effectiveness of the SOC's detection capabilities. The SOC has a high volume of alerts, but many are false positives, and analysts are overwhelmed. Which metric BEST indicates that the SOC needs to tune its detection rules to reduce noise?

A security manager is developing a business continuity plan (BCP) for the security operations center (SOC). The plan must ensure that critical monitoring and response capabilities continue during a disaster that disables the primary SOC. Which strategy BEST addresses this requirement?