ICE Executive cyber investigation role |
Practice Exam Questions & Answers
ID14140
,ICE Executive cyber investigation role | Practice Exam Questions & Answers
1. An automation job reports partial success across the environment. With respect 10. A system must be recovered without losing the current audit trail. Which
to Cloud, virtualization and shared-responsibility security considerations, what action is most likely to prevent recurrence of a problem involving threat
is the best FIRST action? analysis?
A. Assume the most recent change is the cause without checking logs or state. A. Disable security controls permanently to remove the symptom.
B. Compare the observed state with the intended configuration and preserve a rollback B. Compare the observed state with the intended configuration and preserve a rollback
path. path, then confirm that the corrective action is effective before closure.
C. Erase or rotate the relevant logs before establishing the cause. C. Restart every dependent service before collecting any diagnostic evidence.
D. Make several unrelated changes at once so one of them is likely to work. D. Apply an untested production change and rely on users to report whether it worked.
Correct Answer: B Correct Answer: B
Explanation: The strongest exam-style response is the one that controls immediate risk, Explanation: The correct response protects the integrity of the process: establish the
checks the relevant condition, and then acts within the defined requirements for Cloud, facts, apply the appropriate control, and verify the result before closure.
virtualization and shared-responsibility security considerations.
11. A maintenance window is opened after an unplanned outage. Which sequence is
2. An automation job reports partial success across the environment. Which most appropriate when carrying out Incident response, containment, eradication,
evidence is most important when evaluating shared-responsibility security recovery and lessons learned?
considerations? A. Apply the least-privilege fix and validate the affected service after the change,
A. Review storage capacity, filesystem state and I/O errors and compare the findings then verify the resulting state before moving to the next step.
with the applicable criteria. B. Erase or rotate the relevant logs before establishing the cause.
B. Restart every dependent service before collecting any diagnostic evidence. C. Make several unrelated changes at once so one of them is likely to work.
C. Apply an untested production change and rely on users to report whether it worked. D. Assume the most recent change is the cause without checking logs or state.
D. Disable security controls permanently to remove the symptom. Correct Answer: A
Correct Answer: A Explanation: This approach preserves control of the situation while producing evidence
Explanation: The correct response protects the integrity of the process: establish the that can confirm whether the action actually corrected the issue involving Incident
facts, apply the appropriate control, and verify the result before closure. response, containment, eradication, recovery and lessons learned.
3. An administrator finds a configuration drift between two hosts. Which response 12. A recent change is suspected after application latency rises; three
best controls the primary risk associated with Application security, secure consecutive health checks fail. Which choice demonstrates the strongest control
development and common software vulnerabilities? of Incident response?
A. Make several unrelated changes at once so one of them is likely to work. A. Use a tested, documented change and confirm post-change health before closing the
B. Compare the observed state with the intended configuration and preserve a rollback incident.
path. B. Apply an untested production change and rely on users to report whether it worked.
C. Assume the most recent change is the cause without checking logs or state. C. Disable security controls permanently to remove the symptom.
D. Erase or rotate the relevant logs before establishing the cause. D. Restart every dependent service before collecting any diagnostic evidence.
Correct Answer: B Correct Answer: A
Explanation: This approach preserves control of the situation while producing evidence Explanation: This answer uses verified evidence before action, which reduces the chance
that can confirm whether the action actually corrected the issue involving Application of masking the real problem and supports a traceable decision about Incident response.
security, secure development and common software vulnerabilities.
13. A maintenance window is opened after an unplanned outage. What is required
4. A security review identifies an unexpected privilege path; a service exits before accepting the result related to lessons learned?
twice within ten minutes. Before proceeding with work involving Application A. Assume the most recent change is the cause without checking logs or state.
security, what should be verified? B. Erase or rotate the relevant logs before establishing the cause.
A. Review service status, recent logs and dependency health and compare the findings C. Make several unrelated changes at once so one of them is likely to work.
with the applicable criteria. D. Review health probes, events and application logs and compare the findings with the
B. Disable security controls permanently to remove the symptom. applicable criteria.
C. Restart every dependent service before collecting any diagnostic evidence. Correct Answer: D
D. Apply an untested production change and rely on users to report whether it worked. Explanation: The selected action best supports safe, compliant, and technically sound
Correct Answer: A performance because it addresses lessons learned using observable evidence rather than
Explanation: This answer uses verified evidence before action, which reduces the chance convenience.
of masking the real problem and supports a traceable decision about Application
security.
14. A production service begins failing health checks. Under these conditions,
when should the issue involving Business continuity, resilience and
5. A maintenance window is opened after an unplanned outage. Which disaster-recovery planning be escalated?
troubleshooting approach is most appropriate for secure development? A. Restart every dependent service before collecting any diagnostic evidence.
A. Erase or rotate the relevant logs before establishing the cause. B. Apply an untested production change and rely on users to report whether it worked.
B. Make several unrelated changes at once so one of them is likely to work. C. Disable security controls permanently to remove the symptom.
C. Assume the most recent change is the cause without checking logs or state. D. Use a tested, documented change and confirm post-change health before closing the
D. Compare the observed state with the intended configuration and preserve a rollback incident.
path. Correct Answer: D
Correct Answer: D Explanation: A defensible professional decision should be based on current evidence and
Explanation: The selected action best supports safe, compliant, and technically sound applicable criteria. The other choices rely on assumption, remove safeguards, or change
performance because it addresses secure development using observable evidence rather conditions before the cause is understood.
than convenience.
15. A maintenance window is opened after an unplanned outage. Which comparison is
6. An administrator finds a configuration drift between two hosts. Which action most useful for interpreting Business continuity?
best supports a defensible decision about common software vulnerabilities? A. Make several unrelated changes at once so one of them is likely to work.
A. Apply an untested production change and rely on users to report whether it worked. B. Review current policy enforcement and access-control denials and compare the
B. Use a tested, documented change and confirm post-change health before closing the findings with the applicable criteria.
incident. C. Assume the most recent change is the cause without checking logs or state.
C. Disable security controls permanently to remove the symptom. D. Erase or rotate the relevant logs before establishing the cause.
D. Restart every dependent service before collecting any diagnostic evidence. Correct Answer: B
Correct Answer: B Explanation: This is the most appropriate option because it connects the observed
Explanation: A defensible professional decision should be based on current evidence and condition to the governing requirement and leaves a record of why the decision was made.
applicable criteria. The other choices rely on assumption, remove safeguards, or change
conditions before the cause is understood. 16. A production service begins failing health checks; CPU utilization reaches
96%. Which action best distinguishes the underlying cause from a symptom in
7. A recent change is suspected after application latency rises. A change disaster-recovery planning?
affecting Security monitoring, logging, detection engineering and threat analysis A. Disable security controls permanently to remove the symptom.
is being considered. How should it be handled? B. Restart every dependent service before collecting any diagnostic evidence.
A. Compare the observed state with the intended configuration and preserve a rollback C. Compare the observed state with the intended configuration and preserve a rollback
path. path, then confirm that the corrective action is effective before closure.
B. Assume the most recent change is the cause without checking logs or state. D. Apply an untested production change and rely on users to report whether it worked.
C. Erase or rotate the relevant logs before establishing the cause. Correct Answer: C
D. Make several unrelated changes at once so one of them is likely to work. Explanation: The correct choice follows a verify-act-confirm sequence. That is more
Correct Answer: A reliable than bypassing controls or making multiple uncontrolled changes.
Explanation: This is the most appropriate option because it connects the observed
condition to the governing requirement and leaves a record of why the decision was made. 17. An automation job reports partial success across the environment. Which
response is most consistent with the professional or compliance requirements
8. A production service begins failing health checks; CPU utilization reaches governing Third-party, supply-chain and compliance risk?
96%. The abnormal condition directly affects Security monitoring. What is the A. Erase or rotate the relevant logs before establishing the cause.
most appropriate response? B. Compare the observed state with the intended configuration and preserve a rollback
A. Restart every dependent service before collecting any diagnostic evidence. path.
B. Apply an untested production change and rely on users to report whether it worked. C. Make several unrelated changes at once so one of them is likely to work.
C. Disable security controls permanently to remove the symptom. D. Assume the most recent change is the cause without checking logs or state.
D. Use a tested, documented change and confirm post-change health before closing the Correct Answer: B
incident. Explanation: The strongest exam-style response is the one that controls immediate risk,
Correct Answer: D checks the relevant condition, and then acts within the defined requirements for
Explanation: The correct choice follows a verify-act-confirm sequence. That is more Third-party, supply-chain and compliance risk.
reliable than bypassing controls or making multiple uncontrolled changes.
18. An administrator finds a configuration drift between two hosts. Which handoff
9. A deployment succeeds on one node but fails on another. Which documentation practice best reduces error risk for compliance risk?
approach best supports traceability for detection engineering? A. Apply an untested production change and rely on users to report whether it worked.
A. Record the observed condition, supporting evidence, decision and responsible B. Disable security controls permanently to remove the symptom.
follow-up; communicate any unresolved risk to the next responsible person. C. Restart every dependent service before collecting any diagnostic evidence.
B. Make several unrelated changes at once so one of them is likely to work. D. Record the observed condition, supporting evidence, decision and responsible
C. Assume the most recent change is the cause without checking logs or state. follow-up; communicate any unresolved risk to the next responsible person.
D. Erase or rotate the relevant logs before establishing the cause. Correct Answer: D
Correct Answer: A Explanation: The correct response protects the integrity of the process: establish the
Explanation: The strongest exam-style response is the one that controls immediate risk, facts, apply the appropriate control, and verify the result before closure.
checks the relevant condition, and then acts within the defined requirements for
detection engineering.
1
,ICE Executive cyber investigation role | Practice Exam Questions & Answers
19. A system must be recovered without losing the current audit trail. Which 28. A deployment succeeds on one node but fails on another; latency rises from 40
decision about Security assessment, testing and remediation prioritization is ms to 420 ms. The abnormal condition directly affects privileged access. What is
best supported by the available evidence? the most appropriate response?
A. Assume the most recent change is the cause without checking logs or state. A. Use a tested, documented change and confirm post-change health before closing the
B. Erase or rotate the relevant logs before establishing the cause. incident.
C. Make several unrelated changes at once so one of them is likely to work. B. Disable security controls permanently to remove the symptom.
D. Compare the observed state with the intended configuration and preserve a rollback C. Restart every dependent service before collecting any diagnostic evidence.
path. D. Apply an untested production change and rely on users to report whether it worked.
Correct Answer: D Correct Answer: A
Explanation: This approach preserves control of the situation while producing evidence Explanation: This answer uses verified evidence before action, which reduces the chance
that can confirm whether the action actually corrected the issue involving Security of masking the real problem and supports a traceable decision about privileged access.
assessment, testing and remediation prioritization.
29. One interface comes up without the expected DNS settings. Which documentation
20. An administrator finds a configuration drift between two hosts; three approach best supports traceability for Network security architecture,
consecutive health checks fail. Which review step adds the most value before segmentation and secure communications?
closing work involving Security assessment? A. Add multiple default routes until connectivity returns.
A. Restart every dependent service before collecting any diagnostic evidence. B. Restart all networked applications before verifying interface state.
B. Apply an untested production change and rely on users to report whether it worked. C. Record the observed condition, supporting evidence, decision and responsible
C. Disable security controls permanently to remove the symptom. follow-up; communicate any unresolved risk to the next responsible person.
D. Compare the observed state with the intended configuration and preserve a rollback D. Change the hostname because dns lookup failed.
path, then confirm that the corrective action is effective before closure. Correct Answer: C
Correct Answer: D Explanation: The selected action best supports safe, compliant, and technically sound
Explanation: This answer uses verified evidence before action, which reduces the chance performance because it addresses Network security architecture, segmentation and secure
of masking the real problem and supports a traceable decision about Security assessment. communications using observable evidence rather than convenience.
21. An automation job reports partial success across the environment. With 30. One interface comes up without the expected DNS settings. Which action is
respect to remediation prioritization, what is the best FIRST action? most likely to prevent recurrence of a problem involving Network security
A. Make several unrelated changes at once so one of them is likely to work. architecture?
B. Assume the most recent change is the cause without checking logs or state. A. Change the hostname because dns lookup failed.
C. Compare the observed state with the intended configuration and preserve a rollback B. Compare the active connection profile with the intended persistent configuration
path. and test name resolution separately from ip reachability, then confirm that the
D. Erase or rotate the relevant logs before establishing the cause. corrective action is effective before closure.
Correct Answer: C C. Flush every firewall rule before checking the route.
Explanation: The selected action best supports safe, compliant, and technically sound D. Restart all networked applications before verifying interface state.
performance because it addresses remediation prioritization using observable evidence Correct Answer: B
rather than convenience. Explanation: A defensible professional decision should be based on current evidence and
applicable criteria. The other choices rely on assumption, remove safeguards, or change
22. An automation job reports partial success across the environment. Which
conditions before the cause is understood.
evidence is most important when evaluating Security governance, risk management
and policy implementation? 31. A deployment succeeds on one node but fails on another. Which sequence is
A. Disable security controls permanently to remove the symptom. most appropriate when carrying out secure communications?
B. Restart every dependent service before collecting any diagnostic evidence. A. Assume the most recent change is the cause without checking logs or state.
C. Apply an untested production change and rely on users to report whether it worked. B. Collect evidence from the failing component and its dependencies before restarting
D. Review resource utilization, error logs and network reachability and compare the services, then verify the resulting state before moving to the next step.
findings with the applicable criteria. C. Erase or rotate the relevant logs before establishing the cause.
Correct Answer: D D. Make several unrelated changes at once so one of them is likely to work.
Explanation: A defensible professional decision should be based on current evidence and Correct Answer: B
applicable criteria. The other choices rely on assumption, remove safeguards, or change Explanation: This is the most appropriate option because it connects the observed
conditions before the cause is understood. condition to the governing requirement and leaves a record of why the decision was made.
23. An automation job reports partial success across the environment. Which 32. Users report intermittent access while core services remain online; a
response best controls the primary risk associated with Security governance? filesystem reaches 98% capacity. Which choice demonstrates the strongest control
A. Erase or rotate the relevant logs before establishing the cause. of Cloud, virtualization and shared-responsibility security considerations?
B. Compare the observed state with the intended configuration and preserve a rollback A. Use a tested, documented change and confirm post-change health before closing the
path. incident.
C. Make several unrelated changes at once so one of them is likely to work. B. Restart every dependent service before collecting any diagnostic evidence.
D. Assume the most recent change is the cause without checking logs or state. C. Apply an untested production change and rely on users to report whether it worked.
Correct Answer: B D. Disable security controls permanently to remove the symptom.
Explanation: This is the most appropriate option because it connects the observed Correct Answer: A
condition to the governing requirement and leaves a record of why the decision was made. Explanation: The correct choice follows a verify-act-confirm sequence. That is more
reliable than bypassing controls or making multiple uncontrolled changes.
24. A production service begins failing health checks; CPU utilization reaches
96%. Before proceeding with work involving risk management, what should be 33. Users report intermittent access while core services remain online. What is
verified? required before accepting the result related to shared-responsibility security
A. Review package/version state and recent change records and compare the findings considerations?
with the applicable criteria. A. Review configuration history and a tested rollback point and compare the findings
B. Apply an untested production change and rely on users to report whether it worked. with the applicable criteria.
C. Disable security controls permanently to remove the symptom. B. Make several unrelated changes at once so one of them is likely to work.
D. Restart every dependent service before collecting any diagnostic evidence. C. Assume the most recent change is the cause without checking logs or state.
Correct Answer: A D. Erase or rotate the relevant logs before establishing the cause.
Explanation: The correct choice follows a verify-act-confirm sequence. That is more Correct Answer: A
reliable than bypassing controls or making multiple uncontrolled changes. Explanation: The strongest exam-style response is the one that controls immediate risk,
checks the relevant condition, and then acts within the defined requirements for
25. A deployment succeeds on one node but fails on another. Which troubleshooting
shared-responsibility security considerations.
approach is most appropriate for policy implementation?
A. Assume the most recent change is the cause without checking logs or state. 34. A deployment succeeds on one node but fails on another. Under these
B. Compare the observed state with the intended configuration and preserve a rollback conditions, when should the issue involving Application security, secure
path. development and common software vulnerabilities be escalated?
C. Erase or rotate the relevant logs before establishing the cause. A. Disable security controls permanently to remove the symptom.
D. Make several unrelated changes at once so one of them is likely to work. B. Restart every dependent service before collecting any diagnostic evidence.
Correct Answer: B C. Apply an untested production change and rely on users to report whether it worked.
Explanation: The strongest exam-style response is the one that controls immediate risk, D. Use a tested, documented change and confirm post-change health before closing the
checks the relevant condition, and then acts within the defined requirements for policy incident.
implementation. Correct Answer: D
Explanation: The correct response protects the integrity of the process: establish the
26. Users report intermittent access while core services remain online. Which
facts, apply the appropriate control, and verify the result before closure.
action best supports a defensible decision about Identity and access management,
authentication and privileged access? 35. An automation job reports partial success across the environment. Which
A. Restart every dependent service before collecting any diagnostic evidence. comparison is most useful for interpreting Application security?
B. Use a tested, documented change and confirm post-change health before closing the A. Erase or rotate the relevant logs before establishing the cause.
incident. B. Make several unrelated changes at once so one of them is likely to work.
C. Apply an untested production change and rely on users to report whether it worked. C. Review authentication records and effective permissions and compare the findings
D. Disable security controls permanently to remove the symptom. with the applicable criteria.
Correct Answer: B D. Assume the most recent change is the cause without checking logs or state.
Explanation: The correct response protects the integrity of the process: establish the Correct Answer: C
facts, apply the appropriate control, and verify the result before closure. Explanation: This approach preserves control of the situation while producing evidence
that can confirm whether the action actually corrected the issue involving Application
27. A system must be recovered without losing the current audit trail. A change
security.
affecting access management is being considered. How should it be handled?
A. Make several unrelated changes at once so one of them is likely to work. 36. An administrator finds a configuration drift between two hosts; three
B. Assume the most recent change is the cause without checking logs or state. consecutive health checks fail. Which action best distinguishes the underlying
C. Erase or rotate the relevant logs before establishing the cause. cause from a symptom in secure development?
D. Compare the observed state with the intended configuration and preserve a rollback A. Apply an untested production change and rely on users to report whether it worked.
path. B. Compare the observed state with the intended configuration and preserve a rollback
Correct Answer: D path, then confirm that the corrective action is effective before closure.
Explanation: This approach preserves control of the situation while producing evidence C. Disable security controls permanently to remove the symptom.
that can confirm whether the action actually corrected the issue involving access D. Restart every dependent service before collecting any diagnostic evidence.
management. Correct Answer: B
Explanation: This answer uses verified evidence before action, which reduces the chance
of masking the real problem and supports a traceable decision about secure development.
2
, ICE Executive cyber investigation role | Practice Exam Questions & Answers
37. A deployment succeeds on one node but fails on another. Which response is 46. An administrator finds a configuration drift between two hosts. Which action
most consistent with the professional or compliance requirements governing common best supports a defensible decision about Business continuity?
software vulnerabilities? A. Disable security controls permanently to remove the symptom.
A. Assume the most recent change is the cause without checking logs or state. B. Restart every dependent service before collecting any diagnostic evidence.
B. Compare the observed state with the intended configuration and preserve a rollback C. Use a tested, documented change and confirm post-change health before closing the
path. incident.
C. Erase or rotate the relevant logs before establishing the cause. D. Apply an untested production change and rely on users to report whether it worked.
D. Make several unrelated changes at once so one of them is likely to work. Correct Answer: C
Correct Answer: B Explanation: A defensible professional decision should be based on current evidence and
Explanation: The selected action best supports safe, compliant, and technically sound applicable criteria. The other choices rely on assumption, remove safeguards, or change
performance because it addresses common software vulnerabilities using observable conditions before the cause is understood.
evidence rather than convenience.
47. A maintenance window is opened after an unplanned outage. A change affecting
38. A system must be recovered without losing the current audit trail. Which disaster-recovery planning is being considered. How should it be handled?
handoff practice best reduces error risk for Security monitoring, logging, A. Erase or rotate the relevant logs before establishing the cause.
detection engineering and threat analysis? B. Compare the observed state with the intended configuration and preserve a rollback
A. Restart every dependent service before collecting any diagnostic evidence. path.
B. Apply an untested production change and rely on users to report whether it worked. C. Make several unrelated changes at once so one of them is likely to work.
C. Record the observed condition, supporting evidence, decision and responsible D. Assume the most recent change is the cause without checking logs or state.
follow-up; communicate any unresolved risk to the next responsible person. Correct Answer: B
D. Disable security controls permanently to remove the symptom. Explanation: This is the most appropriate option because it connects the observed
Correct Answer: C condition to the governing requirement and leaves a record of why the decision was made.
Explanation: A defensible professional decision should be based on current evidence and
48. Users report intermittent access while core services remain online; a
applicable criteria. The other choices rely on assumption, remove safeguards, or change
conditions before the cause is understood.
filesystem reaches 98% capacity. The abnormal condition directly affects
Third-party, supply-chain and compliance risk. What is the most appropriate
39. A maintenance window is opened after an unplanned outage. Which decision response?
about Security monitoring is best supported by the available evidence? A. Apply an untested production change and rely on users to report whether it worked.
A. Compare the observed state with the intended configuration and preserve a rollback B. Disable security controls permanently to remove the symptom.
path. C. Use a tested, documented change and confirm post-change health before closing the
B. Make several unrelated changes at once so one of them is likely to work. incident.
C. Assume the most recent change is the cause without checking logs or state. D. Restart every dependent service before collecting any diagnostic evidence.
D. Erase or rotate the relevant logs before establishing the cause. Correct Answer: C
Correct Answer: A Explanation: The correct choice follows a verify-act-confirm sequence. That is more
Explanation: This is the most appropriate option because it connects the observed reliable than bypassing controls or making multiple uncontrolled changes.
condition to the governing requirement and leaves a record of why the decision was made.
49. A deployment succeeds on one node but fails on another. Which documentation
40. A security review identifies an unexpected privilege path; a service exits approach best supports traceability for compliance risk?
twice within ten minutes. Which review step adds the most value before closing A. Record the observed condition, supporting evidence, decision and responsible
work involving detection engineering? follow-up; communicate any unresolved risk to the next responsible person.
A. Compare the observed state with the intended configuration and preserve a rollback B. Assume the most recent change is the cause without checking logs or state.
path, then confirm that the corrective action is effective before closure. C. Erase or rotate the relevant logs before establishing the cause.
B. Disable security controls permanently to remove the symptom. D. Make several unrelated changes at once so one of them is likely to work.
C. Restart every dependent service before collecting any diagnostic evidence. Correct Answer: A
D. Apply an untested production change and rely on users to report whether it worked. Explanation: The strongest exam-style response is the one that controls immediate risk,
Correct Answer: A checks the relevant condition, and then acts within the defined requirements for
Explanation: The correct choice follows a verify-act-confirm sequence. That is more compliance risk.
reliable than bypassing controls or making multiple uncontrolled changes.
50. A platform upgrade is planned for a business-critical workload. Which action
41. A platform upgrade is planned for a business-critical workload. With respect is most likely to prevent recurrence of a problem involving Security assessment,
to threat analysis, what is the best FIRST action? testing and remediation prioritization?
A. Erase or rotate the relevant logs before establishing the cause. A. Compare the observed state with the intended configuration and preserve a rollback
B. Make several unrelated changes at once so one of them is likely to work. path, then confirm that the corrective action is effective before closure.
C. Assume the most recent change is the cause without checking logs or state. B. Restart every dependent service before collecting any diagnostic evidence.
D. Compare the observed state with the intended configuration and preserve a rollback C. Apply an untested production change and rely on users to report whether it worked.
path. D. Disable security controls permanently to remove the symptom.
Correct Answer: D Correct Answer: A
Explanation: The strongest exam-style response is the one that controls immediate risk, Explanation: The correct response protects the integrity of the process: establish the
checks the relevant condition, and then acts within the defined requirements for threat facts, apply the appropriate control, and verify the result before closure.
analysis.
51. A deployment succeeds on one node but fails on another. Which sequence is
42. An administrator finds a configuration drift between two hosts. Which most appropriate when carrying out Security assessment?
evidence is most important when evaluating Incident response, containment, A. Make several unrelated changes at once so one of them is likely to work.
eradication, recovery and lessons learned? B. Assume the most recent change is the cause without checking logs or state.
A. Apply an untested production change and rely on users to report whether it worked. C. Erase or rotate the relevant logs before establishing the cause.
B. Disable security controls permanently to remove the symptom. D. Compare the observed state with the intended configuration and preserve a rollback
C. Restart every dependent service before collecting any diagnostic evidence. path, then verify the resulting state before moving to the next step.
D. Review storage capacity, filesystem state and I/O errors and compare the findings Correct Answer: D
with the applicable criteria. Explanation: This approach preserves control of the situation while producing evidence
Correct Answer: D that can confirm whether the action actually corrected the issue involving Security
Explanation: The correct response protects the integrity of the process: establish the assessment.
facts, apply the appropriate control, and verify the result before closure.
52. Users report intermittent access while core services remain online; a
43. A system must be recovered without losing the current audit trail. Which filesystem reaches 98% capacity. Which choice demonstrates the strongest control
response best controls the primary risk associated with Incident response? of remediation prioritization?
A. Assume the most recent change is the cause without checking logs or state. A. Disable security controls permanently to remove the symptom.
B. Erase or rotate the relevant logs before establishing the cause. B. Use a tested, documented change and confirm post-change health before closing the
C. Make several unrelated changes at once so one of them is likely to work. incident.
D. Compare the observed state with the intended configuration and preserve a rollback C. Restart every dependent service before collecting any diagnostic evidence.
path. D. Apply an untested production change and rely on users to report whether it worked.
Correct Answer: D Correct Answer: B
Explanation: This approach preserves control of the situation while producing evidence Explanation: This answer uses verified evidence before action, which reduces the chance
that can confirm whether the action actually corrected the issue involving Incident of masking the real problem and supports a traceable decision about remediation
response. prioritization.
44. An administrator finds a configuration drift between two hosts; three 53. Users report intermittent access while core services remain online. What is
consecutive health checks fail. Before proceeding with work involving lessons required before accepting the result related to Security governance, risk
learned, what should be verified? management and policy implementation?
A. Restart every dependent service before collecting any diagnostic evidence. A. Erase or rotate the relevant logs before establishing the cause.
B. Apply an untested production change and rely on users to report whether it worked. B. Review health probes, events and application logs and compare the findings with the
C. Review service status, recent logs and dependency health and compare the findings applicable criteria.
with the applicable criteria. C. Make several unrelated changes at once so one of them is likely to work.
D. Disable security controls permanently to remove the symptom. D. Assume the most recent change is the cause without checking logs or state.
Correct Answer: C Correct Answer: B
Explanation: This answer uses verified evidence before action, which reduces the chance Explanation: The selected action best supports safe, compliant, and technically sound
of masking the real problem and supports a traceable decision about lessons learned. performance because it addresses Security governance, risk management and policy
implementation using observable evidence rather than convenience.
45. A maintenance window is opened after an unplanned outage. Which
troubleshooting approach is most appropriate for Business continuity, resilience 54. Users report intermittent access while core services remain online. Under
and disaster-recovery planning? these conditions, when should the issue involving Security governance be
A. Make several unrelated changes at once so one of them is likely to work. escalated?
B. Assume the most recent change is the cause without checking logs or state. A. Apply an untested production change and rely on users to report whether it worked.
C. Erase or rotate the relevant logs before establishing the cause. B. Disable security controls permanently to remove the symptom.
D. Compare the observed state with the intended configuration and preserve a rollback C. Restart every dependent service before collecting any diagnostic evidence.
path. D. Use a tested, documented change and confirm post-change health before closing the
Correct Answer: D incident.
Explanation: The selected action best supports safe, compliant, and technically sound Correct Answer: D
performance because it addresses Business continuity, resilience and disaster-recovery Explanation: A defensible professional decision should be based on current evidence and
planning using observable evidence rather than convenience. applicable criteria. The other choices rely on assumption, remove safeguards, or change
conditions before the cause is understood.
3
Practice Exam Questions & Answers
ID14140
,ICE Executive cyber investigation role | Practice Exam Questions & Answers
1. An automation job reports partial success across the environment. With respect 10. A system must be recovered without losing the current audit trail. Which
to Cloud, virtualization and shared-responsibility security considerations, what action is most likely to prevent recurrence of a problem involving threat
is the best FIRST action? analysis?
A. Assume the most recent change is the cause without checking logs or state. A. Disable security controls permanently to remove the symptom.
B. Compare the observed state with the intended configuration and preserve a rollback B. Compare the observed state with the intended configuration and preserve a rollback
path. path, then confirm that the corrective action is effective before closure.
C. Erase or rotate the relevant logs before establishing the cause. C. Restart every dependent service before collecting any diagnostic evidence.
D. Make several unrelated changes at once so one of them is likely to work. D. Apply an untested production change and rely on users to report whether it worked.
Correct Answer: B Correct Answer: B
Explanation: The strongest exam-style response is the one that controls immediate risk, Explanation: The correct response protects the integrity of the process: establish the
checks the relevant condition, and then acts within the defined requirements for Cloud, facts, apply the appropriate control, and verify the result before closure.
virtualization and shared-responsibility security considerations.
11. A maintenance window is opened after an unplanned outage. Which sequence is
2. An automation job reports partial success across the environment. Which most appropriate when carrying out Incident response, containment, eradication,
evidence is most important when evaluating shared-responsibility security recovery and lessons learned?
considerations? A. Apply the least-privilege fix and validate the affected service after the change,
A. Review storage capacity, filesystem state and I/O errors and compare the findings then verify the resulting state before moving to the next step.
with the applicable criteria. B. Erase or rotate the relevant logs before establishing the cause.
B. Restart every dependent service before collecting any diagnostic evidence. C. Make several unrelated changes at once so one of them is likely to work.
C. Apply an untested production change and rely on users to report whether it worked. D. Assume the most recent change is the cause without checking logs or state.
D. Disable security controls permanently to remove the symptom. Correct Answer: A
Correct Answer: A Explanation: This approach preserves control of the situation while producing evidence
Explanation: The correct response protects the integrity of the process: establish the that can confirm whether the action actually corrected the issue involving Incident
facts, apply the appropriate control, and verify the result before closure. response, containment, eradication, recovery and lessons learned.
3. An administrator finds a configuration drift between two hosts. Which response 12. A recent change is suspected after application latency rises; three
best controls the primary risk associated with Application security, secure consecutive health checks fail. Which choice demonstrates the strongest control
development and common software vulnerabilities? of Incident response?
A. Make several unrelated changes at once so one of them is likely to work. A. Use a tested, documented change and confirm post-change health before closing the
B. Compare the observed state with the intended configuration and preserve a rollback incident.
path. B. Apply an untested production change and rely on users to report whether it worked.
C. Assume the most recent change is the cause without checking logs or state. C. Disable security controls permanently to remove the symptom.
D. Erase or rotate the relevant logs before establishing the cause. D. Restart every dependent service before collecting any diagnostic evidence.
Correct Answer: B Correct Answer: A
Explanation: This approach preserves control of the situation while producing evidence Explanation: This answer uses verified evidence before action, which reduces the chance
that can confirm whether the action actually corrected the issue involving Application of masking the real problem and supports a traceable decision about Incident response.
security, secure development and common software vulnerabilities.
13. A maintenance window is opened after an unplanned outage. What is required
4. A security review identifies an unexpected privilege path; a service exits before accepting the result related to lessons learned?
twice within ten minutes. Before proceeding with work involving Application A. Assume the most recent change is the cause without checking logs or state.
security, what should be verified? B. Erase or rotate the relevant logs before establishing the cause.
A. Review service status, recent logs and dependency health and compare the findings C. Make several unrelated changes at once so one of them is likely to work.
with the applicable criteria. D. Review health probes, events and application logs and compare the findings with the
B. Disable security controls permanently to remove the symptom. applicable criteria.
C. Restart every dependent service before collecting any diagnostic evidence. Correct Answer: D
D. Apply an untested production change and rely on users to report whether it worked. Explanation: The selected action best supports safe, compliant, and technically sound
Correct Answer: A performance because it addresses lessons learned using observable evidence rather than
Explanation: This answer uses verified evidence before action, which reduces the chance convenience.
of masking the real problem and supports a traceable decision about Application
security.
14. A production service begins failing health checks. Under these conditions,
when should the issue involving Business continuity, resilience and
5. A maintenance window is opened after an unplanned outage. Which disaster-recovery planning be escalated?
troubleshooting approach is most appropriate for secure development? A. Restart every dependent service before collecting any diagnostic evidence.
A. Erase or rotate the relevant logs before establishing the cause. B. Apply an untested production change and rely on users to report whether it worked.
B. Make several unrelated changes at once so one of them is likely to work. C. Disable security controls permanently to remove the symptom.
C. Assume the most recent change is the cause without checking logs or state. D. Use a tested, documented change and confirm post-change health before closing the
D. Compare the observed state with the intended configuration and preserve a rollback incident.
path. Correct Answer: D
Correct Answer: D Explanation: A defensible professional decision should be based on current evidence and
Explanation: The selected action best supports safe, compliant, and technically sound applicable criteria. The other choices rely on assumption, remove safeguards, or change
performance because it addresses secure development using observable evidence rather conditions before the cause is understood.
than convenience.
15. A maintenance window is opened after an unplanned outage. Which comparison is
6. An administrator finds a configuration drift between two hosts. Which action most useful for interpreting Business continuity?
best supports a defensible decision about common software vulnerabilities? A. Make several unrelated changes at once so one of them is likely to work.
A. Apply an untested production change and rely on users to report whether it worked. B. Review current policy enforcement and access-control denials and compare the
B. Use a tested, documented change and confirm post-change health before closing the findings with the applicable criteria.
incident. C. Assume the most recent change is the cause without checking logs or state.
C. Disable security controls permanently to remove the symptom. D. Erase or rotate the relevant logs before establishing the cause.
D. Restart every dependent service before collecting any diagnostic evidence. Correct Answer: B
Correct Answer: B Explanation: This is the most appropriate option because it connects the observed
Explanation: A defensible professional decision should be based on current evidence and condition to the governing requirement and leaves a record of why the decision was made.
applicable criteria. The other choices rely on assumption, remove safeguards, or change
conditions before the cause is understood. 16. A production service begins failing health checks; CPU utilization reaches
96%. Which action best distinguishes the underlying cause from a symptom in
7. A recent change is suspected after application latency rises. A change disaster-recovery planning?
affecting Security monitoring, logging, detection engineering and threat analysis A. Disable security controls permanently to remove the symptom.
is being considered. How should it be handled? B. Restart every dependent service before collecting any diagnostic evidence.
A. Compare the observed state with the intended configuration and preserve a rollback C. Compare the observed state with the intended configuration and preserve a rollback
path. path, then confirm that the corrective action is effective before closure.
B. Assume the most recent change is the cause without checking logs or state. D. Apply an untested production change and rely on users to report whether it worked.
C. Erase or rotate the relevant logs before establishing the cause. Correct Answer: C
D. Make several unrelated changes at once so one of them is likely to work. Explanation: The correct choice follows a verify-act-confirm sequence. That is more
Correct Answer: A reliable than bypassing controls or making multiple uncontrolled changes.
Explanation: This is the most appropriate option because it connects the observed
condition to the governing requirement and leaves a record of why the decision was made. 17. An automation job reports partial success across the environment. Which
response is most consistent with the professional or compliance requirements
8. A production service begins failing health checks; CPU utilization reaches governing Third-party, supply-chain and compliance risk?
96%. The abnormal condition directly affects Security monitoring. What is the A. Erase or rotate the relevant logs before establishing the cause.
most appropriate response? B. Compare the observed state with the intended configuration and preserve a rollback
A. Restart every dependent service before collecting any diagnostic evidence. path.
B. Apply an untested production change and rely on users to report whether it worked. C. Make several unrelated changes at once so one of them is likely to work.
C. Disable security controls permanently to remove the symptom. D. Assume the most recent change is the cause without checking logs or state.
D. Use a tested, documented change and confirm post-change health before closing the Correct Answer: B
incident. Explanation: The strongest exam-style response is the one that controls immediate risk,
Correct Answer: D checks the relevant condition, and then acts within the defined requirements for
Explanation: The correct choice follows a verify-act-confirm sequence. That is more Third-party, supply-chain and compliance risk.
reliable than bypassing controls or making multiple uncontrolled changes.
18. An administrator finds a configuration drift between two hosts. Which handoff
9. A deployment succeeds on one node but fails on another. Which documentation practice best reduces error risk for compliance risk?
approach best supports traceability for detection engineering? A. Apply an untested production change and rely on users to report whether it worked.
A. Record the observed condition, supporting evidence, decision and responsible B. Disable security controls permanently to remove the symptom.
follow-up; communicate any unresolved risk to the next responsible person. C. Restart every dependent service before collecting any diagnostic evidence.
B. Make several unrelated changes at once so one of them is likely to work. D. Record the observed condition, supporting evidence, decision and responsible
C. Assume the most recent change is the cause without checking logs or state. follow-up; communicate any unresolved risk to the next responsible person.
D. Erase or rotate the relevant logs before establishing the cause. Correct Answer: D
Correct Answer: A Explanation: The correct response protects the integrity of the process: establish the
Explanation: The strongest exam-style response is the one that controls immediate risk, facts, apply the appropriate control, and verify the result before closure.
checks the relevant condition, and then acts within the defined requirements for
detection engineering.
1
,ICE Executive cyber investigation role | Practice Exam Questions & Answers
19. A system must be recovered without losing the current audit trail. Which 28. A deployment succeeds on one node but fails on another; latency rises from 40
decision about Security assessment, testing and remediation prioritization is ms to 420 ms. The abnormal condition directly affects privileged access. What is
best supported by the available evidence? the most appropriate response?
A. Assume the most recent change is the cause without checking logs or state. A. Use a tested, documented change and confirm post-change health before closing the
B. Erase or rotate the relevant logs before establishing the cause. incident.
C. Make several unrelated changes at once so one of them is likely to work. B. Disable security controls permanently to remove the symptom.
D. Compare the observed state with the intended configuration and preserve a rollback C. Restart every dependent service before collecting any diagnostic evidence.
path. D. Apply an untested production change and rely on users to report whether it worked.
Correct Answer: D Correct Answer: A
Explanation: This approach preserves control of the situation while producing evidence Explanation: This answer uses verified evidence before action, which reduces the chance
that can confirm whether the action actually corrected the issue involving Security of masking the real problem and supports a traceable decision about privileged access.
assessment, testing and remediation prioritization.
29. One interface comes up without the expected DNS settings. Which documentation
20. An administrator finds a configuration drift between two hosts; three approach best supports traceability for Network security architecture,
consecutive health checks fail. Which review step adds the most value before segmentation and secure communications?
closing work involving Security assessment? A. Add multiple default routes until connectivity returns.
A. Restart every dependent service before collecting any diagnostic evidence. B. Restart all networked applications before verifying interface state.
B. Apply an untested production change and rely on users to report whether it worked. C. Record the observed condition, supporting evidence, decision and responsible
C. Disable security controls permanently to remove the symptom. follow-up; communicate any unresolved risk to the next responsible person.
D. Compare the observed state with the intended configuration and preserve a rollback D. Change the hostname because dns lookup failed.
path, then confirm that the corrective action is effective before closure. Correct Answer: C
Correct Answer: D Explanation: The selected action best supports safe, compliant, and technically sound
Explanation: This answer uses verified evidence before action, which reduces the chance performance because it addresses Network security architecture, segmentation and secure
of masking the real problem and supports a traceable decision about Security assessment. communications using observable evidence rather than convenience.
21. An automation job reports partial success across the environment. With 30. One interface comes up without the expected DNS settings. Which action is
respect to remediation prioritization, what is the best FIRST action? most likely to prevent recurrence of a problem involving Network security
A. Make several unrelated changes at once so one of them is likely to work. architecture?
B. Assume the most recent change is the cause without checking logs or state. A. Change the hostname because dns lookup failed.
C. Compare the observed state with the intended configuration and preserve a rollback B. Compare the active connection profile with the intended persistent configuration
path. and test name resolution separately from ip reachability, then confirm that the
D. Erase or rotate the relevant logs before establishing the cause. corrective action is effective before closure.
Correct Answer: C C. Flush every firewall rule before checking the route.
Explanation: The selected action best supports safe, compliant, and technically sound D. Restart all networked applications before verifying interface state.
performance because it addresses remediation prioritization using observable evidence Correct Answer: B
rather than convenience. Explanation: A defensible professional decision should be based on current evidence and
applicable criteria. The other choices rely on assumption, remove safeguards, or change
22. An automation job reports partial success across the environment. Which
conditions before the cause is understood.
evidence is most important when evaluating Security governance, risk management
and policy implementation? 31. A deployment succeeds on one node but fails on another. Which sequence is
A. Disable security controls permanently to remove the symptom. most appropriate when carrying out secure communications?
B. Restart every dependent service before collecting any diagnostic evidence. A. Assume the most recent change is the cause without checking logs or state.
C. Apply an untested production change and rely on users to report whether it worked. B. Collect evidence from the failing component and its dependencies before restarting
D. Review resource utilization, error logs and network reachability and compare the services, then verify the resulting state before moving to the next step.
findings with the applicable criteria. C. Erase or rotate the relevant logs before establishing the cause.
Correct Answer: D D. Make several unrelated changes at once so one of them is likely to work.
Explanation: A defensible professional decision should be based on current evidence and Correct Answer: B
applicable criteria. The other choices rely on assumption, remove safeguards, or change Explanation: This is the most appropriate option because it connects the observed
conditions before the cause is understood. condition to the governing requirement and leaves a record of why the decision was made.
23. An automation job reports partial success across the environment. Which 32. Users report intermittent access while core services remain online; a
response best controls the primary risk associated with Security governance? filesystem reaches 98% capacity. Which choice demonstrates the strongest control
A. Erase or rotate the relevant logs before establishing the cause. of Cloud, virtualization and shared-responsibility security considerations?
B. Compare the observed state with the intended configuration and preserve a rollback A. Use a tested, documented change and confirm post-change health before closing the
path. incident.
C. Make several unrelated changes at once so one of them is likely to work. B. Restart every dependent service before collecting any diagnostic evidence.
D. Assume the most recent change is the cause without checking logs or state. C. Apply an untested production change and rely on users to report whether it worked.
Correct Answer: B D. Disable security controls permanently to remove the symptom.
Explanation: This is the most appropriate option because it connects the observed Correct Answer: A
condition to the governing requirement and leaves a record of why the decision was made. Explanation: The correct choice follows a verify-act-confirm sequence. That is more
reliable than bypassing controls or making multiple uncontrolled changes.
24. A production service begins failing health checks; CPU utilization reaches
96%. Before proceeding with work involving risk management, what should be 33. Users report intermittent access while core services remain online. What is
verified? required before accepting the result related to shared-responsibility security
A. Review package/version state and recent change records and compare the findings considerations?
with the applicable criteria. A. Review configuration history and a tested rollback point and compare the findings
B. Apply an untested production change and rely on users to report whether it worked. with the applicable criteria.
C. Disable security controls permanently to remove the symptom. B. Make several unrelated changes at once so one of them is likely to work.
D. Restart every dependent service before collecting any diagnostic evidence. C. Assume the most recent change is the cause without checking logs or state.
Correct Answer: A D. Erase or rotate the relevant logs before establishing the cause.
Explanation: The correct choice follows a verify-act-confirm sequence. That is more Correct Answer: A
reliable than bypassing controls or making multiple uncontrolled changes. Explanation: The strongest exam-style response is the one that controls immediate risk,
checks the relevant condition, and then acts within the defined requirements for
25. A deployment succeeds on one node but fails on another. Which troubleshooting
shared-responsibility security considerations.
approach is most appropriate for policy implementation?
A. Assume the most recent change is the cause without checking logs or state. 34. A deployment succeeds on one node but fails on another. Under these
B. Compare the observed state with the intended configuration and preserve a rollback conditions, when should the issue involving Application security, secure
path. development and common software vulnerabilities be escalated?
C. Erase or rotate the relevant logs before establishing the cause. A. Disable security controls permanently to remove the symptom.
D. Make several unrelated changes at once so one of them is likely to work. B. Restart every dependent service before collecting any diagnostic evidence.
Correct Answer: B C. Apply an untested production change and rely on users to report whether it worked.
Explanation: The strongest exam-style response is the one that controls immediate risk, D. Use a tested, documented change and confirm post-change health before closing the
checks the relevant condition, and then acts within the defined requirements for policy incident.
implementation. Correct Answer: D
Explanation: The correct response protects the integrity of the process: establish the
26. Users report intermittent access while core services remain online. Which
facts, apply the appropriate control, and verify the result before closure.
action best supports a defensible decision about Identity and access management,
authentication and privileged access? 35. An automation job reports partial success across the environment. Which
A. Restart every dependent service before collecting any diagnostic evidence. comparison is most useful for interpreting Application security?
B. Use a tested, documented change and confirm post-change health before closing the A. Erase or rotate the relevant logs before establishing the cause.
incident. B. Make several unrelated changes at once so one of them is likely to work.
C. Apply an untested production change and rely on users to report whether it worked. C. Review authentication records and effective permissions and compare the findings
D. Disable security controls permanently to remove the symptom. with the applicable criteria.
Correct Answer: B D. Assume the most recent change is the cause without checking logs or state.
Explanation: The correct response protects the integrity of the process: establish the Correct Answer: C
facts, apply the appropriate control, and verify the result before closure. Explanation: This approach preserves control of the situation while producing evidence
that can confirm whether the action actually corrected the issue involving Application
27. A system must be recovered without losing the current audit trail. A change
security.
affecting access management is being considered. How should it be handled?
A. Make several unrelated changes at once so one of them is likely to work. 36. An administrator finds a configuration drift between two hosts; three
B. Assume the most recent change is the cause without checking logs or state. consecutive health checks fail. Which action best distinguishes the underlying
C. Erase or rotate the relevant logs before establishing the cause. cause from a symptom in secure development?
D. Compare the observed state with the intended configuration and preserve a rollback A. Apply an untested production change and rely on users to report whether it worked.
path. B. Compare the observed state with the intended configuration and preserve a rollback
Correct Answer: D path, then confirm that the corrective action is effective before closure.
Explanation: This approach preserves control of the situation while producing evidence C. Disable security controls permanently to remove the symptom.
that can confirm whether the action actually corrected the issue involving access D. Restart every dependent service before collecting any diagnostic evidence.
management. Correct Answer: B
Explanation: This answer uses verified evidence before action, which reduces the chance
of masking the real problem and supports a traceable decision about secure development.
2
, ICE Executive cyber investigation role | Practice Exam Questions & Answers
37. A deployment succeeds on one node but fails on another. Which response is 46. An administrator finds a configuration drift between two hosts. Which action
most consistent with the professional or compliance requirements governing common best supports a defensible decision about Business continuity?
software vulnerabilities? A. Disable security controls permanently to remove the symptom.
A. Assume the most recent change is the cause without checking logs or state. B. Restart every dependent service before collecting any diagnostic evidence.
B. Compare the observed state with the intended configuration and preserve a rollback C. Use a tested, documented change and confirm post-change health before closing the
path. incident.
C. Erase or rotate the relevant logs before establishing the cause. D. Apply an untested production change and rely on users to report whether it worked.
D. Make several unrelated changes at once so one of them is likely to work. Correct Answer: C
Correct Answer: B Explanation: A defensible professional decision should be based on current evidence and
Explanation: The selected action best supports safe, compliant, and technically sound applicable criteria. The other choices rely on assumption, remove safeguards, or change
performance because it addresses common software vulnerabilities using observable conditions before the cause is understood.
evidence rather than convenience.
47. A maintenance window is opened after an unplanned outage. A change affecting
38. A system must be recovered without losing the current audit trail. Which disaster-recovery planning is being considered. How should it be handled?
handoff practice best reduces error risk for Security monitoring, logging, A. Erase or rotate the relevant logs before establishing the cause.
detection engineering and threat analysis? B. Compare the observed state with the intended configuration and preserve a rollback
A. Restart every dependent service before collecting any diagnostic evidence. path.
B. Apply an untested production change and rely on users to report whether it worked. C. Make several unrelated changes at once so one of them is likely to work.
C. Record the observed condition, supporting evidence, decision and responsible D. Assume the most recent change is the cause without checking logs or state.
follow-up; communicate any unresolved risk to the next responsible person. Correct Answer: B
D. Disable security controls permanently to remove the symptom. Explanation: This is the most appropriate option because it connects the observed
Correct Answer: C condition to the governing requirement and leaves a record of why the decision was made.
Explanation: A defensible professional decision should be based on current evidence and
48. Users report intermittent access while core services remain online; a
applicable criteria. The other choices rely on assumption, remove safeguards, or change
conditions before the cause is understood.
filesystem reaches 98% capacity. The abnormal condition directly affects
Third-party, supply-chain and compliance risk. What is the most appropriate
39. A maintenance window is opened after an unplanned outage. Which decision response?
about Security monitoring is best supported by the available evidence? A. Apply an untested production change and rely on users to report whether it worked.
A. Compare the observed state with the intended configuration and preserve a rollback B. Disable security controls permanently to remove the symptom.
path. C. Use a tested, documented change and confirm post-change health before closing the
B. Make several unrelated changes at once so one of them is likely to work. incident.
C. Assume the most recent change is the cause without checking logs or state. D. Restart every dependent service before collecting any diagnostic evidence.
D. Erase or rotate the relevant logs before establishing the cause. Correct Answer: C
Correct Answer: A Explanation: The correct choice follows a verify-act-confirm sequence. That is more
Explanation: This is the most appropriate option because it connects the observed reliable than bypassing controls or making multiple uncontrolled changes.
condition to the governing requirement and leaves a record of why the decision was made.
49. A deployment succeeds on one node but fails on another. Which documentation
40. A security review identifies an unexpected privilege path; a service exits approach best supports traceability for compliance risk?
twice within ten minutes. Which review step adds the most value before closing A. Record the observed condition, supporting evidence, decision and responsible
work involving detection engineering? follow-up; communicate any unresolved risk to the next responsible person.
A. Compare the observed state with the intended configuration and preserve a rollback B. Assume the most recent change is the cause without checking logs or state.
path, then confirm that the corrective action is effective before closure. C. Erase or rotate the relevant logs before establishing the cause.
B. Disable security controls permanently to remove the symptom. D. Make several unrelated changes at once so one of them is likely to work.
C. Restart every dependent service before collecting any diagnostic evidence. Correct Answer: A
D. Apply an untested production change and rely on users to report whether it worked. Explanation: The strongest exam-style response is the one that controls immediate risk,
Correct Answer: A checks the relevant condition, and then acts within the defined requirements for
Explanation: The correct choice follows a verify-act-confirm sequence. That is more compliance risk.
reliable than bypassing controls or making multiple uncontrolled changes.
50. A platform upgrade is planned for a business-critical workload. Which action
41. A platform upgrade is planned for a business-critical workload. With respect is most likely to prevent recurrence of a problem involving Security assessment,
to threat analysis, what is the best FIRST action? testing and remediation prioritization?
A. Erase or rotate the relevant logs before establishing the cause. A. Compare the observed state with the intended configuration and preserve a rollback
B. Make several unrelated changes at once so one of them is likely to work. path, then confirm that the corrective action is effective before closure.
C. Assume the most recent change is the cause without checking logs or state. B. Restart every dependent service before collecting any diagnostic evidence.
D. Compare the observed state with the intended configuration and preserve a rollback C. Apply an untested production change and rely on users to report whether it worked.
path. D. Disable security controls permanently to remove the symptom.
Correct Answer: D Correct Answer: A
Explanation: The strongest exam-style response is the one that controls immediate risk, Explanation: The correct response protects the integrity of the process: establish the
checks the relevant condition, and then acts within the defined requirements for threat facts, apply the appropriate control, and verify the result before closure.
analysis.
51. A deployment succeeds on one node but fails on another. Which sequence is
42. An administrator finds a configuration drift between two hosts. Which most appropriate when carrying out Security assessment?
evidence is most important when evaluating Incident response, containment, A. Make several unrelated changes at once so one of them is likely to work.
eradication, recovery and lessons learned? B. Assume the most recent change is the cause without checking logs or state.
A. Apply an untested production change and rely on users to report whether it worked. C. Erase or rotate the relevant logs before establishing the cause.
B. Disable security controls permanently to remove the symptom. D. Compare the observed state with the intended configuration and preserve a rollback
C. Restart every dependent service before collecting any diagnostic evidence. path, then verify the resulting state before moving to the next step.
D. Review storage capacity, filesystem state and I/O errors and compare the findings Correct Answer: D
with the applicable criteria. Explanation: This approach preserves control of the situation while producing evidence
Correct Answer: D that can confirm whether the action actually corrected the issue involving Security
Explanation: The correct response protects the integrity of the process: establish the assessment.
facts, apply the appropriate control, and verify the result before closure.
52. Users report intermittent access while core services remain online; a
43. A system must be recovered without losing the current audit trail. Which filesystem reaches 98% capacity. Which choice demonstrates the strongest control
response best controls the primary risk associated with Incident response? of remediation prioritization?
A. Assume the most recent change is the cause without checking logs or state. A. Disable security controls permanently to remove the symptom.
B. Erase or rotate the relevant logs before establishing the cause. B. Use a tested, documented change and confirm post-change health before closing the
C. Make several unrelated changes at once so one of them is likely to work. incident.
D. Compare the observed state with the intended configuration and preserve a rollback C. Restart every dependent service before collecting any diagnostic evidence.
path. D. Apply an untested production change and rely on users to report whether it worked.
Correct Answer: D Correct Answer: B
Explanation: This approach preserves control of the situation while producing evidence Explanation: This answer uses verified evidence before action, which reduces the chance
that can confirm whether the action actually corrected the issue involving Incident of masking the real problem and supports a traceable decision about remediation
response. prioritization.
44. An administrator finds a configuration drift between two hosts; three 53. Users report intermittent access while core services remain online. What is
consecutive health checks fail. Before proceeding with work involving lessons required before accepting the result related to Security governance, risk
learned, what should be verified? management and policy implementation?
A. Restart every dependent service before collecting any diagnostic evidence. A. Erase or rotate the relevant logs before establishing the cause.
B. Apply an untested production change and rely on users to report whether it worked. B. Review health probes, events and application logs and compare the findings with the
C. Review service status, recent logs and dependency health and compare the findings applicable criteria.
with the applicable criteria. C. Make several unrelated changes at once so one of them is likely to work.
D. Disable security controls permanently to remove the symptom. D. Assume the most recent change is the cause without checking logs or state.
Correct Answer: C Correct Answer: B
Explanation: This answer uses verified evidence before action, which reduces the chance Explanation: The selected action best supports safe, compliant, and technically sound
of masking the real problem and supports a traceable decision about lessons learned. performance because it addresses Security governance, risk management and policy
implementation using observable evidence rather than convenience.
45. A maintenance window is opened after an unplanned outage. Which
troubleshooting approach is most appropriate for Business continuity, resilience 54. Users report intermittent access while core services remain online. Under
and disaster-recovery planning? these conditions, when should the issue involving Security governance be
A. Make several unrelated changes at once so one of them is likely to work. escalated?
B. Assume the most recent change is the cause without checking logs or state. A. Apply an untested production change and rely on users to report whether it worked.
C. Erase or rotate the relevant logs before establishing the cause. B. Disable security controls permanently to remove the symptom.
D. Compare the observed state with the intended configuration and preserve a rollback C. Restart every dependent service before collecting any diagnostic evidence.
path. D. Use a tested, documented change and confirm post-change health before closing the
Correct Answer: D incident.
Explanation: The selected action best supports safe, compliant, and technically sound Correct Answer: D
performance because it addresses Business continuity, resilience and disaster-recovery Explanation: A defensible professional decision should be based on current evidence and
planning using observable evidence rather than convenience. applicable criteria. The other choices rely on assumption, remove safeguards, or change
conditions before the cause is understood.
3
