Security Operations and Administration

An organization's backup policy states: 'Maintain three copies of data on two different media types, with one copy stored offsite.' This is known as:

Which TWO of the following are examples of physical security controls? (Select TWO)

A company has a backup policy that performs a full backup every Sunday and incremental backups on other days. On Wednesday, a server fails. How many backup sets are needed to restore the server to its state on Tuesday night?

Which backup type copies all data that has changed since the last full backup, regardless of subsequent backups?

A security analyst notices multiple failed login attempts on a critical server followed by a successful login from an unusual IP address. Which metric would BEST capture this event?

A security administrator is evaluating backup strategies for a critical database with a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour. Which backup approach best meets these requirements?

An employee is leaving the company. As part of the offboarding process, which action should be taken regarding the hardware assigned to the employee?

An organization wants to ensure that sensitive data on laptops is protected in case of loss or theft. Which control is MOST effective?

During a physical security audit, it is discovered that employees often prop open the mantrap door to allow easier access. What is the BEST control to address this?

A change request to update a critical database server has been approved by the Change Advisory Board (CAB). During testing, a major compatibility issue is discovered. What is the best course of action?

An organization's security policy prohibits employees from sharing passwords. What type of policy is this?

A vulnerability scan identifies a critical vulnerability on a web server with a CVSS score of 9.8. The server hosts a public-facing application. However, the patch would require a reboot that would cause downtime during business hours. What should the security administrator do FIRST?

During a security audit, it is found that several employees have written their passwords on sticky notes attached to their monitors. Which policy is being violated?

A change request to update a firewall rule has been submitted. After impact assessment, the change is approved by the Change Advisory Board (CAB). What is the NEXT step in the change management process?

A company wants to ensure that employees understand the proper use of corporate email and internet. Which policy should they implement?

What is the primary purpose of a baseline configuration in configuration management?

A company uses a backup strategy that backs up all data every Sunday and backs up only data that has changed since the last full backup on other days. This is an example of which backup type?

A security administrator is selecting security metrics for the organization. Which TWO metrics are most useful for measuring the effectiveness of patching? (Select TWO)

Which of the following is the correct order of steps in the change management process?

During a post-implementation review of a change, it is discovered that the change introduced a configuration deviation from the baseline. The deviation was not detected during testing. What is the BEST way to prevent this in the future?

A company is implementing a new access control system for its data center. Which physical security control is best for preventing tailgating?

A security metric tracking the percentage of systems with critical patches applied within 48 hours is an example of which type of metric?

An organization's security policy requires that all portable media containing sensitive data be encrypted. Which type of control does this requirement represent?

Which physical security control is designed to prevent tailgating by allowing only one person to enter at a time?

An organization uses a mantrap at its main entrance. An employee badges in, enters the first door, but then the second door fails to open. What should the employee do?

Which TWO of the following are key components of a configuration management database (CMDB)? (Select TWO)

A security administrator is designing physical security for a high-security area. Which TWO controls are most effective for preventing unauthorized entry? (Select TWO)

A company is implementing a change management process. Which THREE elements are essential for every change request? (Select THREE)

A security awareness training program is being developed. Which topic is most important to include to reduce the risk of credential theft?

An organization is implementing a software inventory management process. Which TWO of the following should be tracked for each software asset?

A security administrator is drafting an acceptable use policy (AUP). Which of the following should be included to address the use of personal devices for work purposes?

An organization wants to ensure that servers are configured securely before deployment. They plan to use a hardened operating system image and regularly scan for deviations using SCAP. Which concept does this represent?

Which THREE of the following are examples of security awareness training topics?

An organization wants to ensure that all new servers are deployed with a hardened baseline configuration. Which of the following is the most effective control to enforce this?

A company is implementing a new patch management process. After scanning for missing patches, the team must prioritize which patches to apply first. Which combination of factors is most critical for prioritization?

During a change management process, the Change Advisory Board (CAB) approves a high-risk change. What is the NEXT step according to standard change management?

A security administrator needs to ensure that all servers are configured with a hardened baseline. Which tool is best suited to detect deviations from the baseline configuration?

Which of the following backup methods copies all data that has changed since the last full backup, regardless of any intermediate backups?

A company's backup strategy uses a full backup on Sundays and differential backups on other days. On Thursday, the storage system fails. How many backups are required to restore the data?

A critical vulnerability with a CVSS score of 9.8 is discovered in a web server that cannot be patched due to vendor dependency. What is the best compensating control?

During a security awareness training session, an employee asks how to identify a phishing email. Which of the following is the most reliable indicator of a phishing attempt?

Which of the following is a key principle of the 3-2-1 backup rule?

An organization is enhancing its backup strategy. According to the 3-2-1 rule, which THREE characteristics must the backup strategy include? (Select THREE)

An organization is implementing configuration management and wants to detect unauthorized changes to server configurations. Which of the following tools would be most effective for this purpose?

During a post-implementation review of a recent change, it is found that the change introduced a security vulnerability. What TWO actions should be taken? (Select TWO)

Which THREE of the following are critical elements of a patch management policy? (Select THREE)

A security administrator is implementing the 3-2-1 backup rule. Which THREE actions are required to comply with this rule? (Select THREE.)

A security administrator receives an alert from the SIEM indicating a configuration change on a critical server. The change was not part of any approved change request. What should be the first step?

A security metric shows that patch compliance is at 85%. The goal is 95%. Which action should be taken first?

A company has a Recovery Time Objective (RTO) of 4 hours for its critical database. Which backup strategy best supports this RTO?

A patch management process is being audited. Which finding indicates a critical gap in the process?

Which THREE of the following are valid steps in the change management process? (Select THREE)

Which TWO of the following are key components of the 3-2-1 backup rule?

A security awareness training program aims to reduce successful phishing attacks. Which metric is most appropriate for measuring the effectiveness of this training?

A company wants to track all hardware assets including serial numbers and locations. What is the primary repository for this information?

Which of the following is the PRIMARY purpose of implementing a clean desk policy?

Which backup type copies all data that has changed since the last full backup, regardless of any incremental backups?

During a change management process, the Change Advisory Board (CAB) has approved a change to update a critical database server. After implementation, a rollback is necessary due to unforeseen performance issues. What should the change manager do next?

Which TWO of the following are key components of the 3-2-1 backup rule? (Select TWO)

An organization uses a SIEM to alert when a server's configuration changes from its hardened baseline. This is an example of:

A security administrator is prioritizing patches for a vulnerability with a CVSS score of 9.8 that is being actively exploited in the wild. The affected server has a low criticality classification. What should the administrator do?

During a security awareness training session, an employee reports receiving an email that appears to be from the CEO requesting an urgent wire transfer. The email has a suspicious domain and poor grammar. Which type of attack is this an example of?

A security administrator needs to dispose of hard drives that contain sensitive data. Which method provides the highest assurance that data cannot be recovered?

An organization needs to recover data from a backup after a ransomware attack. The backup was taken 12 hours ago, and the RPO is 4 hours. What is the impact?