An organization uses Microsoft Sentinel. To ensure that an automated incident response playbook only triggers when a high-severity alert originates from a specific production subnet, where should the condition be defined?
When analyzing network traffic in Wireshark for potential exfiltration, what specific filter allows you to isolate TCP traffic where the payload size exceeds 10MB?
When configuring a Cisco ASA firewall to log deny events to a remote Syslog server, what is the minimum logging level required to ensure that denied packets are captured?
In VMware Carbon Black Cloud, which feature should be enabled to block unauthorized scripts while allowing signed binaries from trusted software vendors?
A security analyst is troubleshooting a failed connection to an internal application that is protected by Zscaler Private Access (ZPA). Which tool should the analyst use to verify if the policy is blocking the request?
Which document is considered the primary 'source of truth' for defining the SOC's roles, responsibilities, and communication paths during a major security incident?
When using Palo Alto Networks Cortex XSOAR, which component is responsible for orchestrating the execution of scripts across multiple third-party integrations?
An organization is investigating a potential lateral movement incident in AWS. Which CloudTrail event field provides the most reliable indicator of the source IP address for an API call performed by an IAM role?
When configuring CrowdStrike Falcon to isolate a host during an active incident, what is the prerequisite requirement for the agent's communication state?
In Tenable.io, when prioritizing vulnerability remediation, which metric provides the best insight into the likelihood of a vulnerability being exploited in the wild?
In Splunk Enterprise Security, which dashboard should the SOC manager review to evaluate the effectiveness of the current correlation searches and the volume of notable events?
A Microsoft Entra ID (Azure AD) user account is suspected of compromise. What is the most effective way to invalidate all active session tokens immediately?
In the context of the Google Cloud Security Command Center (SCC), which feature provides a prioritized list of findings based on the criticality of the impacted asset?
A security manager at a mid-sized financial firm discovers that a privileged database administrator account was used at 02:00 UTC to export 40 GB of customer records to an external IP address. The account was not locked out, no alert fired, and the export completed over 47 minutes. Which action should the manager take FIRST to align with the ISC2 ISSMP incident management lifecycle?
A healthcare organization is building a Security Operations Center and must define how it will measure and govern detection and response performance. The CISO asks the security manager to select metrics that directly reflect the SOC's ability to detect and respond to threats. Which TWO metrics best meet this requirement? (Choose two.)
A security manager is drafting the business continuity plan for a payment processing platform. The CIO asks which element establishes the maximum tolerable time that the payment service can be unavailable before the organization suffers unacceptable financial and regulatory harm. Which concept should the manager document?
During a declared major incident, the incident commander needs to preserve volatile evidence on a compromised Linux server before the platform team rebuilds it. The server hosts a critical billing application and cannot be taken offline for more than 30 minutes. Which action BEST satisfies both the evidentiary requirement and the availability constraint?
A security manager is reviewing the organization's log management program. An auditor notes that several critical servers retain logs for only 7 days, while the incident response policy requires the ability to investigate incidents up to 90 days after detection. The servers generate approximately 50 GB of logs per day. Which action BEST addresses the audit finding while controlling storage cost?
A security manager is building the incident response program for a financial services firm and needs to define the criteria that determine when an event must be escalated to a formally declared incident. Which artifact should be created to document these criteria, the required responders, and the approval chain for escalation?
A security operations manager is reviewing the SOC's use of threat intelligence and wants to ensure that indicators are automatically ingested and matched against event data with minimal latency. Which capability should be prioritized to meet this objective?
A security manager is establishing a formal incident response capability and wants to ensure that lessons learned from major incidents are captured and used to improve future response. Which activity should be conducted after a significant incident to meet this goal?
A security manager is leading the response to a confirmed ransomware outbreak on a file server. The malware is still actively encrypting files and spreading laterally via SMB. Executive leadership asks the manager to authorize immediate containment. Which action BEST satisfies the containment objective while preserving forensic evidence?
A security manager is defining the scope of the organization's incident response program and needs to ensure that the program addresses all phases of the incident handling lifecycle. Which sequence of phases should the manager use as the framework for the program?
A security operations manager is designing a threat intelligence program to improve detection of advanced persistent threats (APTs). The organization wants to prioritize intelligence that is actionable and relevant. Which TWO characteristics of threat intelligence are MOST important for driving effective detection engineering? (Choose two.)
A security manager is reviewing the organization's incident response plan and wants to ensure that evidence collected during an incident is handled in a manner that preserves its integrity for potential legal proceedings. Which TWO practices should be included in the evidence handling procedures? (Choose two.)
A security manager is reviewing the organization's incident response plan. The plan requires that after a major incident, lessons learned are captured and used to improve future response. Which activity BEST ensures that lessons learned are effectively integrated into the security operations program?
A security manager is evaluating the effectiveness of the SOC's detection capabilities. The SOC has a high volume of alerts, but many are false positives, and analysts are overwhelmed. Which metric BEST indicates that the SOC needs to tune its detection rules to reduce noise?
A security manager is developing a business continuity plan (BCP) for the security operations center (SOC). The plan must ensure that critical monitoring and response capabilities continue during a disaster that disables the primary SOC. Which strategy BEST addresses this requirement?