US Executive security role | Comprehensive
Practice Exam Questions & Answers
ID14142
,US Executive security role | Comprehensive Practice Exam Questions & Answers
1. A deployment succeeds on one node but fails on another. With respect to 11. A recent change is suspected after application latency rises. Which sequence
Incident response, containment, eradication, recovery and lessons learned, what is most appropriate when carrying out remediation prioritization?
is the best FIRST action? A. Make several unrelated changes at once so one of them is likely to work.
A. Erase or rotate the relevant logs before establishing the cause. B. Assume the most recent change is the cause without checking logs or state.
B. Make several unrelated changes at once so one of them is likely to work. C. Erase or rotate the relevant logs before establishing the cause.
C. Assume the most recent change is the cause without checking logs or state. D. Collect evidence from the failing component and its dependencies before restarting
D. Apply the least-privilege fix and validate the affected service after the change. services, then verify the resulting state before moving to the next step.
Correct Answer: D Correct Answer: D
Explanation: This approach preserves control of the situation while producing evidence Explanation: The selected action best supports safe, compliant, and technically sound
that can confirm whether the action actually corrected the issue involving Incident performance because it addresses remediation prioritization using observable evidence
response, containment, eradication, recovery and lessons learned. rather than convenience.
2. A platform upgrade is planned for a business-critical workload. Which evidence 12. A recent change is suspected after application latency rises; three
is most important when evaluating Incident response? consecutive health checks fail. Which choice demonstrates the strongest control
A. Apply an untested production change and rely on users to report whether it worked. of Security governance, risk management and policy implementation?
B. Review service status, recent logs and dependency health and compare the findings A. Disable security controls permanently to remove the symptom.
with the applicable criteria. B. Restart every dependent service before collecting any diagnostic evidence.
C. Disable security controls permanently to remove the symptom. C. Apply an untested production change and rely on users to report whether it worked.
D. Restart every dependent service before collecting any diagnostic evidence. D. Verify the current state with logs and service health before changing
Correct Answer: B configuration.
Explanation: This answer uses verified evidence before action, which reduces the chance Correct Answer: D
of masking the real problem and supports a traceable decision about Incident response. Explanation: A defensible professional decision should be based on current evidence and
applicable criteria. The other choices rely on assumption, remove safeguards, or change
3. A deployment succeeds on one node but fails on another. Which response best conditions before the cause is understood.
controls the primary risk associated with lessons learned?
A. Assume the most recent change is the cause without checking logs or state. 13. A recent change is suspected after application latency rises. What is
B. Erase or rotate the relevant logs before establishing the cause. required before accepting the result related to Security governance?
C. Make several unrelated changes at once so one of them is likely to work. A. Erase or rotate the relevant logs before establishing the cause.
D. Apply the least-privilege fix and validate the affected service after the change. B. Review current policy enforcement and access-control denials and compare the
Correct Answer: D findings with the applicable criteria.
Explanation: The selected action best supports safe, compliant, and technically sound C. Make several unrelated changes at once so one of them is likely to work.
performance because it addresses lessons learned using observable evidence rather than D. Assume the most recent change is the cause without checking logs or state.
convenience. Correct Answer: B
Explanation: This is the most appropriate option because it connects the observed
4. An administrator finds a configuration drift between two hosts; three condition to the governing requirement and leaves a record of why the decision was made.
consecutive health checks fail. Before proceeding with work involving Business
continuity, resilience and disaster-recovery planning, what should be verified? 14. An administrator finds a configuration drift between two hosts. Under these
A. Restart every dependent service before collecting any diagnostic evidence. conditions, when should the issue involving risk management be escalated?
B. Apply an untested production change and rely on users to report whether it worked. A. Apply an untested production change and rely on users to report whether it worked.
C. Review resource utilization, error logs and network reachability and compare the B. Disable security controls permanently to remove the symptom.
findings with the applicable criteria. C. Verify the current state with logs and service health before changing
D. Disable security controls permanently to remove the symptom. configuration.
Correct Answer: C D. Restart every dependent service before collecting any diagnostic evidence.
Explanation: A defensible professional decision should be based on current evidence and Correct Answer: C
applicable criteria. The other choices rely on assumption, remove safeguards, or change Explanation: The correct choice follows a verify-act-confirm sequence. That is more
conditions before the cause is understood. reliable than bypassing controls or making multiple uncontrolled changes.
5. A deployment succeeds on one node but fails on another. Which troubleshooting 15. An automation job reports partial success across the environment. Which
approach is most appropriate for Business continuity? comparison is most useful for interpreting policy implementation?
A. Apply the least-privilege fix and validate the affected service after the change. A. Assume the most recent change is the cause without checking logs or state.
B. Make several unrelated changes at once so one of them is likely to work. B. Review configuration history and a tested rollback point and compare the findings
C. Assume the most recent change is the cause without checking logs or state. with the applicable criteria.
D. Erase or rotate the relevant logs before establishing the cause. C. Erase or rotate the relevant logs before establishing the cause.
Correct Answer: A D. Make several unrelated changes at once so one of them is likely to work.
Explanation: This is the most appropriate option because it connects the observed Correct Answer: B
condition to the governing requirement and leaves a record of why the decision was made. Explanation: The strongest exam-style response is the one that controls immediate risk,
checks the relevant condition, and then acts within the defined requirements for policy
6. An administrator finds a configuration drift between two hosts. Which action implementation.
best supports a defensible decision about disaster-recovery planning?
A. Disable security controls permanently to remove the symptom. 16. A system must be recovered without losing the current audit trail; latency
B. Restart every dependent service before collecting any diagnostic evidence. rises from 40 ms to 420 ms. Which action best distinguishes the underlying cause
C. Apply an untested production change and rely on users to report whether it worked. from a symptom in Identity and access management, authentication and privileged
D. Verify the current state with logs and service health before changing access?
configuration. A. Compare the observed state with the intended configuration and preserve a rollback
Correct Answer: D path, then confirm that the corrective action is effective before closure.
Explanation: The correct choice follows a verify-act-confirm sequence. That is more B. Restart every dependent service before collecting any diagnostic evidence.
reliable than bypassing controls or making multiple uncontrolled changes. C. Apply an untested production change and rely on users to report whether it worked.
D. Disable security controls permanently to remove the symptom.
7. A recent change is suspected after application latency rises. A change
Correct Answer: A
affecting Third-party, supply-chain and compliance risk is being considered. How Explanation: The correct response protects the integrity of the process: establish the
should it be handled? facts, apply the appropriate control, and verify the result before closure.
A. Erase or rotate the relevant logs before establishing the cause.
B. Make several unrelated changes at once so one of them is likely to work. 17. A production service begins failing health checks. Which response is most
C. Apply the least-privilege fix and validate the affected service after the change. consistent with the professional or compliance requirements governing access
D. Assume the most recent change is the cause without checking logs or state. management?
Correct Answer: C A. Make several unrelated changes at once so one of them is likely to work.
Explanation: The strongest exam-style response is the one that controls immediate risk, B. Apply the least-privilege fix and validate the affected service after the change.
checks the relevant condition, and then acts within the defined requirements for C. Assume the most recent change is the cause without checking logs or state.
Third-party, supply-chain and compliance risk. D. Erase or rotate the relevant logs before establishing the cause.
Correct Answer: B
8. A security review identifies an unexpected privilege path; a service exits
Explanation: This approach preserves control of the situation while producing evidence
twice within ten minutes. The abnormal condition directly affects compliance that can confirm whether the action actually corrected the issue involving access
risk. What is the most appropriate response? management.
A. Apply an untested production change and rely on users to report whether it worked.
B. Disable security controls permanently to remove the symptom. 18. An automation job reports partial success across the environment. Which
C. Verify the current state with logs and service health before changing handoff practice best reduces error risk for privileged access?
configuration. A. Disable security controls permanently to remove the symptom.
D. Restart every dependent service before collecting any diagnostic evidence. B. Restart every dependent service before collecting any diagnostic evidence.
Correct Answer: C C. Record the observed condition, supporting evidence, decision and responsible
Explanation: The correct response protects the integrity of the process: establish the follow-up; communicate any unresolved risk to the next responsible person.
facts, apply the appropriate control, and verify the result before closure. D. Apply an untested production change and rely on users to report whether it worked.
Correct Answer: C
9. A production service begins failing health checks. Which documentation Explanation: This answer uses verified evidence before action, which reduces the chance
approach best supports traceability for Security assessment, testing and of masking the real problem and supports a traceable decision about privileged access.
remediation prioritization?
A. Assume the most recent change is the cause without checking logs or state. 19. One interface comes up without the expected DNS settings. Which decision
B. Erase or rotate the relevant logs before establishing the cause. about Network security architecture, segmentation and secure communications is
C. Make several unrelated changes at once so one of them is likely to work. best supported by the available evidence?
D. Record the observed condition, supporting evidence, decision and responsible A. Add multiple default routes until connectivity returns.
follow-up; communicate any unresolved risk to the next responsible person. B. Compare the active connection profile with the intended persistent configuration
Correct Answer: D and test name resolution separately from ip reachability.
Explanation: This approach preserves control of the situation while producing evidence C. Restart all networked applications before verifying interface state.
that can confirm whether the action actually corrected the issue involving Security D. Flush every firewall rule before checking the route.
assessment, testing and remediation prioritization. Correct Answer: B
Explanation: The selected action best supports safe, compliant, and technically sound
10. A security review identifies an unexpected privilege path. Which action is performance because it addresses Network security architecture, segmentation and secure
most likely to prevent recurrence of a problem involving Security assessment? communications using observable evidence rather than convenience.
A. Restart every dependent service before collecting any diagnostic evidence.
B. Apply an untested production change and rely on users to report whether it worked.
C. Disable security controls permanently to remove the symptom.
D. Compare the observed state with the intended configuration and preserve a rollback
path, then confirm that the corrective action is effective before closure.
Correct Answer: D
Explanation: This answer uses verified evidence before action, which reduces the chance
of masking the real problem and supports a traceable decision about Security assessment.
1
,US Executive security role | Comprehensive Practice Exam Questions & Answers
20. One interface comes up without the expected DNS settings; latency rises from 30. An automation job reports partial success across the environment. Which
40 ms to 420 ms. Which review step adds the most value before closing work action is most likely to prevent recurrence of a problem involving
involving Network security architecture? shared-responsibility security considerations?
A. Compare the active connection profile with the intended persistent configuration A. Disable security controls permanently to remove the symptom.
and test name resolution separately from ip reachability, then confirm that the B. Compare the observed state with the intended configuration and preserve a rollback
corrective action is effective before closure. path, then confirm that the corrective action is effective before closure.
B. Change the hostname because dns lookup failed. C. Restart every dependent service before collecting any diagnostic evidence.
C. Flush every firewall rule before checking the route. D. Apply an untested production change and rely on users to report whether it worked.
D. Add multiple default routes until connectivity returns. Correct Answer: B
Correct Answer: A Explanation: The correct choice follows a verify-act-confirm sequence. That is more
Explanation: A defensible professional decision should be based on current evidence and reliable than bypassing controls or making multiple uncontrolled changes.
applicable criteria. The other choices rely on assumption, remove safeguards, or change
conditions before the cause is understood. 31. A deployment succeeds on one node but fails on another. Which sequence is
most appropriate when carrying out Incident response, containment, eradication,
21. An automation job reports partial success across the environment. With recovery and lessons learned?
respect to secure communications, what is the best FIRST action? A. Erase or rotate the relevant logs before establishing the cause.
A. Assume the most recent change is the cause without checking logs or state. B. Make several unrelated changes at once so one of them is likely to work.
B. Apply the least-privilege fix and validate the affected service after the change. C. Assume the most recent change is the cause without checking logs or state.
C. Erase or rotate the relevant logs before establishing the cause. D. Compare the observed state with the intended configuration and preserve a rollback
D. Make several unrelated changes at once so one of them is likely to work. path, then verify the resulting state before moving to the next step.
Correct Answer: B Correct Answer: D
Explanation: This is the most appropriate option because it connects the observed Explanation: The strongest exam-style response is the one that controls immediate risk,
condition to the governing requirement and leaves a record of why the decision was made. checks the relevant condition, and then acts within the defined requirements for
Incident response, containment, eradication, recovery and lessons learned.
22. A deployment succeeds on one node but fails on another. Which evidence is
most important when evaluating Cryptography, key management and protection of 32. A platform upgrade is planned for a business-critical workload; a service
data in transit and at rest? exits twice within ten minutes. Which choice demonstrates the strongest control
A. Restart every dependent service before collecting any diagnostic evidence. of Incident response?
B. Apply an untested production change and rely on users to report whether it worked. A. Apply an untested production change and rely on users to report whether it worked.
C. Disable security controls permanently to remove the symptom. B. Verify the current state with logs and service health before changing
D. Review package/version state and recent change records and compare the findings configuration.
with the applicable criteria. C. Disable security controls permanently to remove the symptom.
Correct Answer: D D. Restart every dependent service before collecting any diagnostic evidence.
Explanation: The correct choice follows a verify-act-confirm sequence. That is more Correct Answer: B
reliable than bypassing controls or making multiple uncontrolled changes. Explanation: The correct response protects the integrity of the process: establish the
facts, apply the appropriate control, and verify the result before closure.
23. A platform upgrade is planned for a business-critical workload. Which
response best controls the primary risk associated with key management? 33. A deployment succeeds on one node but fails on another. What is required
A. Make several unrelated changes at once so one of them is likely to work. before accepting the result related to lessons learned?
B. Apply the least-privilege fix and validate the affected service after the change. A. Assume the most recent change is the cause without checking logs or state.
C. Assume the most recent change is the cause without checking logs or state. B. Erase or rotate the relevant logs before establishing the cause.
D. Erase or rotate the relevant logs before establishing the cause. C. Review authentication records and effective permissions and compare the findings
Correct Answer: B with the applicable criteria.
Explanation: The strongest exam-style response is the one that controls immediate risk, D. Make several unrelated changes at once so one of them is likely to work.
checks the relevant condition, and then acts within the defined requirements for key Correct Answer: C
management. Explanation: This approach preserves control of the situation while producing evidence
that can confirm whether the action actually corrected the issue involving lessons
24. A production service begins failing health checks; CPU utilization reaches
learned.
96%. Before proceeding with work involving protection of data in transit, what
should be verified? 34. An administrator finds a configuration drift between two hosts. Under these
A. Disable security controls permanently to remove the symptom. conditions, when should the issue involving Business continuity, resilience and
B. Restart every dependent service before collecting any diagnostic evidence. disaster-recovery planning be escalated?
C. Review storage capacity, filesystem state and I/O errors and compare the findings A. Verify the current state with logs and service health before changing
with the applicable criteria. configuration.
D. Apply an untested production change and rely on users to report whether it worked. B. Restart every dependent service before collecting any diagnostic evidence.
Correct Answer: C C. Apply an untested production change and rely on users to report whether it worked.
Explanation: The correct response protects the integrity of the process: establish the D. Disable security controls permanently to remove the symptom.
facts, apply the appropriate control, and verify the result before closure. Correct Answer: A
Explanation: This answer uses verified evidence before action, which reduces the chance
25. A system must be recovered without losing the current audit trail. Which
of masking the real problem and supports a traceable decision about Business continuity,
troubleshooting approach is most appropriate for at rest? resilience and disaster-recovery planning.
A. Erase or rotate the relevant logs before establishing the cause.
B. Apply the least-privilege fix and validate the affected service after the change. 35. A deployment succeeds on one node but fails on another. Which comparison is
C. Make several unrelated changes at once so one of them is likely to work. most useful for interpreting Business continuity?
D. Assume the most recent change is the cause without checking logs or state. A. Make several unrelated changes at once so one of them is likely to work.
Correct Answer: B B. Assume the most recent change is the cause without checking logs or state.
Explanation: This approach preserves control of the situation while producing evidence C. Erase or rotate the relevant logs before establishing the cause.
that can confirm whether the action actually corrected the issue involving at rest. D. Review health probes, events and application logs and compare the findings with the
applicable criteria.
26. A platform upgrade is planned for a business-critical workload. Which action Correct Answer: D
best supports a defensible decision about Secure configuration, hardening and Explanation: The selected action best supports safe, compliant, and technically sound
vulnerability management? performance because it addresses Business continuity using observable evidence rather
A. Apply an untested production change and rely on users to report whether it worked. than convenience.
B. Verify the current state with logs and service health before changing
configuration. 36. An administrator finds a configuration drift between two hosts; three
C. Disable security controls permanently to remove the symptom. consecutive health checks fail. Which action best distinguishes the underlying
D. Restart every dependent service before collecting any diagnostic evidence. cause from a symptom in disaster-recovery planning?
Correct Answer: B A. Disable security controls permanently to remove the symptom.
Explanation: This answer uses verified evidence before action, which reduces the chance B. Restart every dependent service before collecting any diagnostic evidence.
of masking the real problem and supports a traceable decision about Secure C. Compare the observed state with the intended configuration and preserve a rollback
configuration, hardening and vulnerability management. path, then confirm that the corrective action is effective before closure.
D. Apply an untested production change and rely on users to report whether it worked.
27. Users report intermittent access while core services remain online. A change Correct Answer: C
affecting Secure configuration is being considered. How should it be handled? Explanation: A defensible professional decision should be based on current evidence and
A. Apply the least-privilege fix and validate the affected service after the change. applicable criteria. The other choices rely on assumption, remove safeguards, or change
B. Assume the most recent change is the cause without checking logs or state. conditions before the cause is understood.
C. Erase or rotate the relevant logs before establishing the cause.
D. Make several unrelated changes at once so one of them is likely to work. 37. A recent change is suspected after application latency rises. Which response
Correct Answer: A is most consistent with the professional or compliance requirements governing
Explanation: The selected action best supports safe, compliant, and technically sound Third-party, supply-chain and compliance risk?
performance because it addresses Secure configuration using observable evidence rather A. Apply the least-privilege fix and validate the affected service after the change.
than convenience. B. Erase or rotate the relevant logs before establishing the cause.
C. Make several unrelated changes at once so one of them is likely to work.
28. A deployment succeeds on one node but fails on another; latency rises from 40
D. Assume the most recent change is the cause without checking logs or state.
ms to 420 ms. The abnormal condition directly affects vulnerability management. Correct Answer: A
What is the most appropriate response? Explanation: This is the most appropriate option because it connects the observed
A. Restart every dependent service before collecting any diagnostic evidence. condition to the governing requirement and leaves a record of why the decision was made.
B. Apply an untested production change and rely on users to report whether it worked.
C. Verify the current state with logs and service health before changing 38. A security review identifies an unexpected privilege path. Which handoff
configuration. practice best reduces error risk for compliance risk?
D. Disable security controls permanently to remove the symptom. A. Apply an untested production change and rely on users to report whether it worked.
Correct Answer: C B. Disable security controls permanently to remove the symptom.
Explanation: A defensible professional decision should be based on current evidence and C. Restart every dependent service before collecting any diagnostic evidence.
applicable criteria. The other choices rely on assumption, remove safeguards, or change D. Record the observed condition, supporting evidence, decision and responsible
conditions before the cause is understood. follow-up; communicate any unresolved risk to the next responsible person.
Correct Answer: D
29. An automation job reports partial success across the environment. Which
Explanation: The correct choice follows a verify-act-confirm sequence. That is more
documentation approach best supports traceability for Cloud, virtualization and reliable than bypassing controls or making multiple uncontrolled changes.
shared-responsibility security considerations?
A. Make several unrelated changes at once so one of them is likely to work.
B. Assume the most recent change is the cause without checking logs or state.
C. Erase or rotate the relevant logs before establishing the cause.
D. Record the observed condition, supporting evidence, decision and responsible
follow-up; communicate any unresolved risk to the next responsible person.
Correct Answer: D
Explanation: This is the most appropriate option because it connects the observed
condition to the governing requirement and leaves a record of why the decision was made.
2
, US Executive security role | Comprehensive Practice Exam Questions & Answers
39. A production service begins failing health checks. Which decision about 49. A server has an address but traffic uses the wrong route. Which documentation
Security assessment, testing and remediation prioritization is best supported by approach best supports traceability for Network security architecture,
the available evidence? segmentation and secure communications?
A. Assume the most recent change is the cause without checking logs or state. A. Restart all networked applications before verifying interface state.
B. Erase or rotate the relevant logs before establishing the cause. B. Add multiple default routes until connectivity returns.
C. Make several unrelated changes at once so one of them is likely to work. C. Record the observed condition, supporting evidence, decision and responsible
D. Apply the least-privilege fix and validate the affected service after the change. follow-up; communicate any unresolved risk to the next responsible person.
Correct Answer: D D. Change the hostname because dns lookup failed.
Explanation: The strongest exam-style response is the one that controls immediate risk, Correct Answer: C
checks the relevant condition, and then acts within the defined requirements for Explanation: This approach preserves control of the situation while producing evidence
Security assessment, testing and remediation prioritization. that can confirm whether the action actually corrected the issue involving Network
security architecture, segmentation and secure communications.
40. A security review identifies an unexpected privilege path; a service exits
twice within ten minutes. Which review step adds the most value before closing 50. A server has an address but traffic uses the wrong route. Which action is
work involving Security assessment? most likely to prevent recurrence of a problem involving Network security
A. Restart every dependent service before collecting any diagnostic evidence. architecture?
B. Apply an untested production change and rely on users to report whether it worked. A. Flush every firewall rule before checking the route.
C. Disable security controls permanently to remove the symptom. B. Compare the active connection profile with the intended persistent configuration
D. Compare the observed state with the intended configuration and preserve a rollback and test name resolution separately from ip reachability, then confirm that the
path, then confirm that the corrective action is effective before closure. corrective action is effective before closure.
Correct Answer: D C. Change the hostname because dns lookup failed.
Explanation: The correct response protects the integrity of the process: establish the D. Restart all networked applications before verifying interface state.
facts, apply the appropriate control, and verify the result before closure. Correct Answer: B
Explanation: This answer uses verified evidence before action, which reduces the chance
41. A recent change is suspected after application latency rises. With respect to of masking the real problem and supports a traceable decision about Network security
remediation prioritization, what is the best FIRST action? architecture.
A. Make several unrelated changes at once so one of them is likely to work.
B. Assume the most recent change is the cause without checking logs or state. 51. An automation job reports partial success across the environment. Which
C. Apply the least-privilege fix and validate the affected service after the change. sequence is most appropriate when carrying out secure communications?
D. Erase or rotate the relevant logs before establishing the cause. A. Assume the most recent change is the cause without checking logs or state.
Correct Answer: C B. Erase or rotate the relevant logs before establishing the cause.
Explanation: This approach preserves control of the situation while producing evidence C. Make several unrelated changes at once so one of them is likely to work.
that can confirm whether the action actually corrected the issue involving remediation D. Apply the least-privilege fix and validate the affected service after the change,
prioritization. then verify the resulting state before moving to the next step.
Correct Answer: D
42. A recent change is suspected after application latency rises. Which evidence Explanation: The selected action best supports safe, compliant, and technically sound
is most important when evaluating Security governance, risk management and policy performance because it addresses secure communications using observable evidence rather
implementation? than convenience.
A. Disable security controls permanently to remove the symptom.
B. Review service status, recent logs and dependency health and compare the findings 52. A deployment succeeds on one node but fails on another; latency rises from 40
with the applicable criteria. ms to 420 ms. Which choice demonstrates the strongest control of Cryptography,
C. Restart every dependent service before collecting any diagnostic evidence. key management and protection of data in transit and at rest?
D. Apply an untested production change and rely on users to report whether it worked. A. Restart every dependent service before collecting any diagnostic evidence.
Correct Answer: B B. Apply an untested production change and rely on users to report whether it worked.
Explanation: This answer uses verified evidence before action, which reduces the chance C. Disable security controls permanently to remove the symptom.
of masking the real problem and supports a traceable decision about Security governance, D. Verify the current state with logs and service health before changing
risk management and policy implementation. configuration.
Correct Answer: D
43. A recent change is suspected after application latency rises. Which response Explanation: A defensible professional decision should be based on current evidence and
best controls the primary risk associated with Security governance? applicable criteria. The other choices rely on assumption, remove safeguards, or change
A. Apply the least-privilege fix and validate the affected service after the change. conditions before the cause is understood.
B. Erase or rotate the relevant logs before establishing the cause.
C. Make several unrelated changes at once so one of them is likely to work. 53. A platform upgrade is planned for a business-critical workload. What is
D. Assume the most recent change is the cause without checking logs or state. required before accepting the result related to key management?
Correct Answer: A A. Make several unrelated changes at once so one of them is likely to work.
Explanation: The selected action best supports safe, compliant, and technically sound B. Assume the most recent change is the cause without checking logs or state.
performance because it addresses Security governance using observable evidence rather C. Review current policy enforcement and access-control denials and compare the
than convenience. findings with the applicable criteria.
D. Erase or rotate the relevant logs before establishing the cause.
44. An administrator finds a configuration drift between two hosts; three Correct Answer: C
consecutive health checks fail. Before proceeding with work involving risk Explanation: This is the most appropriate option because it connects the observed
management, what should be verified? condition to the governing requirement and leaves a record of why the decision was made.
A. Apply an untested production change and rely on users to report whether it worked.
B. Disable security controls permanently to remove the symptom. 54. A production service begins failing health checks. Under these conditions,
C. Restart every dependent service before collecting any diagnostic evidence. when should the issue involving protection of data in transit be escalated?
D. Review resource utilization, error logs and network reachability and compare the A. Disable security controls permanently to remove the symptom.
findings with the applicable criteria. B. Verify the current state with logs and service health before changing
Correct Answer: D configuration.
Explanation: A defensible professional decision should be based on current evidence and C. Restart every dependent service before collecting any diagnostic evidence.
applicable criteria. The other choices rely on assumption, remove safeguards, or change D. Apply an untested production change and rely on users to report whether it worked.
conditions before the cause is understood. Correct Answer: B
Explanation: The correct choice follows a verify-act-confirm sequence. That is more
45. An automation job reports partial success across the environment. Which reliable than bypassing controls or making multiple uncontrolled changes.
troubleshooting approach is most appropriate for policy implementation?
A. Assume the most recent change is the cause without checking logs or state. 55. A system must be recovered without losing the current audit trail. Which
B. Erase or rotate the relevant logs before establishing the cause. comparison is most useful for interpreting at rest?
C. Make several unrelated changes at once so one of them is likely to work. A. Erase or rotate the relevant logs before establishing the cause.
D. Apply the least-privilege fix and validate the affected service after the change. B. Make several unrelated changes at once so one of them is likely to work.
Correct Answer: D C. Review configuration history and a tested rollback point and compare the findings
Explanation: This is the most appropriate option because it connects the observed with the applicable criteria.
condition to the governing requirement and leaves a record of why the decision was made. D. Assume the most recent change is the cause without checking logs or state.
Correct Answer: C
46. A system must be recovered without losing the current audit trail. Which Explanation: The strongest exam-style response is the one that controls immediate risk,
action best supports a defensible decision about Identity and access management, checks the relevant condition, and then acts within the defined requirements for at
authentication and privileged access? rest.
A. Restart every dependent service before collecting any diagnostic evidence.
B. Apply an untested production change and rely on users to report whether it worked. 56. A platform upgrade is planned for a business-critical workload; a service
C. Disable security controls permanently to remove the symptom. exits twice within ten minutes. Which action best distinguishes the underlying
D. Verify the current state with logs and service health before changing cause from a symptom in Secure configuration, hardening and vulnerability
configuration. management?
Correct Answer: D A. Compare the observed state with the intended configuration and preserve a rollback
Explanation: The correct choice follows a verify-act-confirm sequence. That is more path, then confirm that the corrective action is effective before closure.
reliable than bypassing controls or making multiple uncontrolled changes. B. Apply an untested production change and rely on users to report whether it worked.
C. Disable security controls permanently to remove the symptom.
47. A production service begins failing health checks. A change affecting access D. Restart every dependent service before collecting any diagnostic evidence.
management is being considered. How should it be handled? Correct Answer: A
A. Apply the least-privilege fix and validate the affected service after the change. Explanation: The correct response protects the integrity of the process: establish the
B. Make several unrelated changes at once so one of them is likely to work. facts, apply the appropriate control, and verify the result before closure.
C. Assume the most recent change is the cause without checking logs or state.
D. Erase or rotate the relevant logs before establishing the cause. 57. Users report intermittent access while core services remain online. Which
Correct Answer: A response is most consistent with the professional or compliance requirements
Explanation: The strongest exam-style response is the one that controls immediate risk, governing Secure configuration?
checks the relevant condition, and then acts within the defined requirements for access A. Assume the most recent change is the cause without checking logs or state.
management. B. Erase or rotate the relevant logs before establishing the cause.
C. Apply the least-privilege fix and validate the affected service after the change.
48. An automation job reports partial success across the environment; CPU
D. Make several unrelated changes at once so one of them is likely to work.
utilization reaches 96%. The abnormal condition directly affects privileged Correct Answer: C
access. What is the most appropriate response? Explanation: This approach preserves control of the situation while producing evidence
A. Disable security controls permanently to remove the symptom. that can confirm whether the action actually corrected the issue involving Secure
B. Verify the current state with logs and service health before changing configuration.
configuration.
C. Restart every dependent service before collecting any diagnostic evidence.
D. Apply an untested production change and rely on users to report whether it worked.
Correct Answer: B
Explanation: The correct response protects the integrity of the process: establish the
facts, apply the appropriate control, and verify the result before closure.
3
Practice Exam Questions & Answers
ID14142
,US Executive security role | Comprehensive Practice Exam Questions & Answers
1. A deployment succeeds on one node but fails on another. With respect to 11. A recent change is suspected after application latency rises. Which sequence
Incident response, containment, eradication, recovery and lessons learned, what is most appropriate when carrying out remediation prioritization?
is the best FIRST action? A. Make several unrelated changes at once so one of them is likely to work.
A. Erase or rotate the relevant logs before establishing the cause. B. Assume the most recent change is the cause without checking logs or state.
B. Make several unrelated changes at once so one of them is likely to work. C. Erase or rotate the relevant logs before establishing the cause.
C. Assume the most recent change is the cause without checking logs or state. D. Collect evidence from the failing component and its dependencies before restarting
D. Apply the least-privilege fix and validate the affected service after the change. services, then verify the resulting state before moving to the next step.
Correct Answer: D Correct Answer: D
Explanation: This approach preserves control of the situation while producing evidence Explanation: The selected action best supports safe, compliant, and technically sound
that can confirm whether the action actually corrected the issue involving Incident performance because it addresses remediation prioritization using observable evidence
response, containment, eradication, recovery and lessons learned. rather than convenience.
2. A platform upgrade is planned for a business-critical workload. Which evidence 12. A recent change is suspected after application latency rises; three
is most important when evaluating Incident response? consecutive health checks fail. Which choice demonstrates the strongest control
A. Apply an untested production change and rely on users to report whether it worked. of Security governance, risk management and policy implementation?
B. Review service status, recent logs and dependency health and compare the findings A. Disable security controls permanently to remove the symptom.
with the applicable criteria. B. Restart every dependent service before collecting any diagnostic evidence.
C. Disable security controls permanently to remove the symptom. C. Apply an untested production change and rely on users to report whether it worked.
D. Restart every dependent service before collecting any diagnostic evidence. D. Verify the current state with logs and service health before changing
Correct Answer: B configuration.
Explanation: This answer uses verified evidence before action, which reduces the chance Correct Answer: D
of masking the real problem and supports a traceable decision about Incident response. Explanation: A defensible professional decision should be based on current evidence and
applicable criteria. The other choices rely on assumption, remove safeguards, or change
3. A deployment succeeds on one node but fails on another. Which response best conditions before the cause is understood.
controls the primary risk associated with lessons learned?
A. Assume the most recent change is the cause without checking logs or state. 13. A recent change is suspected after application latency rises. What is
B. Erase or rotate the relevant logs before establishing the cause. required before accepting the result related to Security governance?
C. Make several unrelated changes at once so one of them is likely to work. A. Erase or rotate the relevant logs before establishing the cause.
D. Apply the least-privilege fix and validate the affected service after the change. B. Review current policy enforcement and access-control denials and compare the
Correct Answer: D findings with the applicable criteria.
Explanation: The selected action best supports safe, compliant, and technically sound C. Make several unrelated changes at once so one of them is likely to work.
performance because it addresses lessons learned using observable evidence rather than D. Assume the most recent change is the cause without checking logs or state.
convenience. Correct Answer: B
Explanation: This is the most appropriate option because it connects the observed
4. An administrator finds a configuration drift between two hosts; three condition to the governing requirement and leaves a record of why the decision was made.
consecutive health checks fail. Before proceeding with work involving Business
continuity, resilience and disaster-recovery planning, what should be verified? 14. An administrator finds a configuration drift between two hosts. Under these
A. Restart every dependent service before collecting any diagnostic evidence. conditions, when should the issue involving risk management be escalated?
B. Apply an untested production change and rely on users to report whether it worked. A. Apply an untested production change and rely on users to report whether it worked.
C. Review resource utilization, error logs and network reachability and compare the B. Disable security controls permanently to remove the symptom.
findings with the applicable criteria. C. Verify the current state with logs and service health before changing
D. Disable security controls permanently to remove the symptom. configuration.
Correct Answer: C D. Restart every dependent service before collecting any diagnostic evidence.
Explanation: A defensible professional decision should be based on current evidence and Correct Answer: C
applicable criteria. The other choices rely on assumption, remove safeguards, or change Explanation: The correct choice follows a verify-act-confirm sequence. That is more
conditions before the cause is understood. reliable than bypassing controls or making multiple uncontrolled changes.
5. A deployment succeeds on one node but fails on another. Which troubleshooting 15. An automation job reports partial success across the environment. Which
approach is most appropriate for Business continuity? comparison is most useful for interpreting policy implementation?
A. Apply the least-privilege fix and validate the affected service after the change. A. Assume the most recent change is the cause without checking logs or state.
B. Make several unrelated changes at once so one of them is likely to work. B. Review configuration history and a tested rollback point and compare the findings
C. Assume the most recent change is the cause without checking logs or state. with the applicable criteria.
D. Erase or rotate the relevant logs before establishing the cause. C. Erase or rotate the relevant logs before establishing the cause.
Correct Answer: A D. Make several unrelated changes at once so one of them is likely to work.
Explanation: This is the most appropriate option because it connects the observed Correct Answer: B
condition to the governing requirement and leaves a record of why the decision was made. Explanation: The strongest exam-style response is the one that controls immediate risk,
checks the relevant condition, and then acts within the defined requirements for policy
6. An administrator finds a configuration drift between two hosts. Which action implementation.
best supports a defensible decision about disaster-recovery planning?
A. Disable security controls permanently to remove the symptom. 16. A system must be recovered without losing the current audit trail; latency
B. Restart every dependent service before collecting any diagnostic evidence. rises from 40 ms to 420 ms. Which action best distinguishes the underlying cause
C. Apply an untested production change and rely on users to report whether it worked. from a symptom in Identity and access management, authentication and privileged
D. Verify the current state with logs and service health before changing access?
configuration. A. Compare the observed state with the intended configuration and preserve a rollback
Correct Answer: D path, then confirm that the corrective action is effective before closure.
Explanation: The correct choice follows a verify-act-confirm sequence. That is more B. Restart every dependent service before collecting any diagnostic evidence.
reliable than bypassing controls or making multiple uncontrolled changes. C. Apply an untested production change and rely on users to report whether it worked.
D. Disable security controls permanently to remove the symptom.
7. A recent change is suspected after application latency rises. A change
Correct Answer: A
affecting Third-party, supply-chain and compliance risk is being considered. How Explanation: The correct response protects the integrity of the process: establish the
should it be handled? facts, apply the appropriate control, and verify the result before closure.
A. Erase or rotate the relevant logs before establishing the cause.
B. Make several unrelated changes at once so one of them is likely to work. 17. A production service begins failing health checks. Which response is most
C. Apply the least-privilege fix and validate the affected service after the change. consistent with the professional or compliance requirements governing access
D. Assume the most recent change is the cause without checking logs or state. management?
Correct Answer: C A. Make several unrelated changes at once so one of them is likely to work.
Explanation: The strongest exam-style response is the one that controls immediate risk, B. Apply the least-privilege fix and validate the affected service after the change.
checks the relevant condition, and then acts within the defined requirements for C. Assume the most recent change is the cause without checking logs or state.
Third-party, supply-chain and compliance risk. D. Erase or rotate the relevant logs before establishing the cause.
Correct Answer: B
8. A security review identifies an unexpected privilege path; a service exits
Explanation: This approach preserves control of the situation while producing evidence
twice within ten minutes. The abnormal condition directly affects compliance that can confirm whether the action actually corrected the issue involving access
risk. What is the most appropriate response? management.
A. Apply an untested production change and rely on users to report whether it worked.
B. Disable security controls permanently to remove the symptom. 18. An automation job reports partial success across the environment. Which
C. Verify the current state with logs and service health before changing handoff practice best reduces error risk for privileged access?
configuration. A. Disable security controls permanently to remove the symptom.
D. Restart every dependent service before collecting any diagnostic evidence. B. Restart every dependent service before collecting any diagnostic evidence.
Correct Answer: C C. Record the observed condition, supporting evidence, decision and responsible
Explanation: The correct response protects the integrity of the process: establish the follow-up; communicate any unresolved risk to the next responsible person.
facts, apply the appropriate control, and verify the result before closure. D. Apply an untested production change and rely on users to report whether it worked.
Correct Answer: C
9. A production service begins failing health checks. Which documentation Explanation: This answer uses verified evidence before action, which reduces the chance
approach best supports traceability for Security assessment, testing and of masking the real problem and supports a traceable decision about privileged access.
remediation prioritization?
A. Assume the most recent change is the cause without checking logs or state. 19. One interface comes up without the expected DNS settings. Which decision
B. Erase or rotate the relevant logs before establishing the cause. about Network security architecture, segmentation and secure communications is
C. Make several unrelated changes at once so one of them is likely to work. best supported by the available evidence?
D. Record the observed condition, supporting evidence, decision and responsible A. Add multiple default routes until connectivity returns.
follow-up; communicate any unresolved risk to the next responsible person. B. Compare the active connection profile with the intended persistent configuration
Correct Answer: D and test name resolution separately from ip reachability.
Explanation: This approach preserves control of the situation while producing evidence C. Restart all networked applications before verifying interface state.
that can confirm whether the action actually corrected the issue involving Security D. Flush every firewall rule before checking the route.
assessment, testing and remediation prioritization. Correct Answer: B
Explanation: The selected action best supports safe, compliant, and technically sound
10. A security review identifies an unexpected privilege path. Which action is performance because it addresses Network security architecture, segmentation and secure
most likely to prevent recurrence of a problem involving Security assessment? communications using observable evidence rather than convenience.
A. Restart every dependent service before collecting any diagnostic evidence.
B. Apply an untested production change and rely on users to report whether it worked.
C. Disable security controls permanently to remove the symptom.
D. Compare the observed state with the intended configuration and preserve a rollback
path, then confirm that the corrective action is effective before closure.
Correct Answer: D
Explanation: This answer uses verified evidence before action, which reduces the chance
of masking the real problem and supports a traceable decision about Security assessment.
1
,US Executive security role | Comprehensive Practice Exam Questions & Answers
20. One interface comes up without the expected DNS settings; latency rises from 30. An automation job reports partial success across the environment. Which
40 ms to 420 ms. Which review step adds the most value before closing work action is most likely to prevent recurrence of a problem involving
involving Network security architecture? shared-responsibility security considerations?
A. Compare the active connection profile with the intended persistent configuration A. Disable security controls permanently to remove the symptom.
and test name resolution separately from ip reachability, then confirm that the B. Compare the observed state with the intended configuration and preserve a rollback
corrective action is effective before closure. path, then confirm that the corrective action is effective before closure.
B. Change the hostname because dns lookup failed. C. Restart every dependent service before collecting any diagnostic evidence.
C. Flush every firewall rule before checking the route. D. Apply an untested production change and rely on users to report whether it worked.
D. Add multiple default routes until connectivity returns. Correct Answer: B
Correct Answer: A Explanation: The correct choice follows a verify-act-confirm sequence. That is more
Explanation: A defensible professional decision should be based on current evidence and reliable than bypassing controls or making multiple uncontrolled changes.
applicable criteria. The other choices rely on assumption, remove safeguards, or change
conditions before the cause is understood. 31. A deployment succeeds on one node but fails on another. Which sequence is
most appropriate when carrying out Incident response, containment, eradication,
21. An automation job reports partial success across the environment. With recovery and lessons learned?
respect to secure communications, what is the best FIRST action? A. Erase or rotate the relevant logs before establishing the cause.
A. Assume the most recent change is the cause without checking logs or state. B. Make several unrelated changes at once so one of them is likely to work.
B. Apply the least-privilege fix and validate the affected service after the change. C. Assume the most recent change is the cause without checking logs or state.
C. Erase or rotate the relevant logs before establishing the cause. D. Compare the observed state with the intended configuration and preserve a rollback
D. Make several unrelated changes at once so one of them is likely to work. path, then verify the resulting state before moving to the next step.
Correct Answer: B Correct Answer: D
Explanation: This is the most appropriate option because it connects the observed Explanation: The strongest exam-style response is the one that controls immediate risk,
condition to the governing requirement and leaves a record of why the decision was made. checks the relevant condition, and then acts within the defined requirements for
Incident response, containment, eradication, recovery and lessons learned.
22. A deployment succeeds on one node but fails on another. Which evidence is
most important when evaluating Cryptography, key management and protection of 32. A platform upgrade is planned for a business-critical workload; a service
data in transit and at rest? exits twice within ten minutes. Which choice demonstrates the strongest control
A. Restart every dependent service before collecting any diagnostic evidence. of Incident response?
B. Apply an untested production change and rely on users to report whether it worked. A. Apply an untested production change and rely on users to report whether it worked.
C. Disable security controls permanently to remove the symptom. B. Verify the current state with logs and service health before changing
D. Review package/version state and recent change records and compare the findings configuration.
with the applicable criteria. C. Disable security controls permanently to remove the symptom.
Correct Answer: D D. Restart every dependent service before collecting any diagnostic evidence.
Explanation: The correct choice follows a verify-act-confirm sequence. That is more Correct Answer: B
reliable than bypassing controls or making multiple uncontrolled changes. Explanation: The correct response protects the integrity of the process: establish the
facts, apply the appropriate control, and verify the result before closure.
23. A platform upgrade is planned for a business-critical workload. Which
response best controls the primary risk associated with key management? 33. A deployment succeeds on one node but fails on another. What is required
A. Make several unrelated changes at once so one of them is likely to work. before accepting the result related to lessons learned?
B. Apply the least-privilege fix and validate the affected service after the change. A. Assume the most recent change is the cause without checking logs or state.
C. Assume the most recent change is the cause without checking logs or state. B. Erase or rotate the relevant logs before establishing the cause.
D. Erase or rotate the relevant logs before establishing the cause. C. Review authentication records and effective permissions and compare the findings
Correct Answer: B with the applicable criteria.
Explanation: The strongest exam-style response is the one that controls immediate risk, D. Make several unrelated changes at once so one of them is likely to work.
checks the relevant condition, and then acts within the defined requirements for key Correct Answer: C
management. Explanation: This approach preserves control of the situation while producing evidence
that can confirm whether the action actually corrected the issue involving lessons
24. A production service begins failing health checks; CPU utilization reaches
learned.
96%. Before proceeding with work involving protection of data in transit, what
should be verified? 34. An administrator finds a configuration drift between two hosts. Under these
A. Disable security controls permanently to remove the symptom. conditions, when should the issue involving Business continuity, resilience and
B. Restart every dependent service before collecting any diagnostic evidence. disaster-recovery planning be escalated?
C. Review storage capacity, filesystem state and I/O errors and compare the findings A. Verify the current state with logs and service health before changing
with the applicable criteria. configuration.
D. Apply an untested production change and rely on users to report whether it worked. B. Restart every dependent service before collecting any diagnostic evidence.
Correct Answer: C C. Apply an untested production change and rely on users to report whether it worked.
Explanation: The correct response protects the integrity of the process: establish the D. Disable security controls permanently to remove the symptom.
facts, apply the appropriate control, and verify the result before closure. Correct Answer: A
Explanation: This answer uses verified evidence before action, which reduces the chance
25. A system must be recovered without losing the current audit trail. Which
of masking the real problem and supports a traceable decision about Business continuity,
troubleshooting approach is most appropriate for at rest? resilience and disaster-recovery planning.
A. Erase or rotate the relevant logs before establishing the cause.
B. Apply the least-privilege fix and validate the affected service after the change. 35. A deployment succeeds on one node but fails on another. Which comparison is
C. Make several unrelated changes at once so one of them is likely to work. most useful for interpreting Business continuity?
D. Assume the most recent change is the cause without checking logs or state. A. Make several unrelated changes at once so one of them is likely to work.
Correct Answer: B B. Assume the most recent change is the cause without checking logs or state.
Explanation: This approach preserves control of the situation while producing evidence C. Erase or rotate the relevant logs before establishing the cause.
that can confirm whether the action actually corrected the issue involving at rest. D. Review health probes, events and application logs and compare the findings with the
applicable criteria.
26. A platform upgrade is planned for a business-critical workload. Which action Correct Answer: D
best supports a defensible decision about Secure configuration, hardening and Explanation: The selected action best supports safe, compliant, and technically sound
vulnerability management? performance because it addresses Business continuity using observable evidence rather
A. Apply an untested production change and rely on users to report whether it worked. than convenience.
B. Verify the current state with logs and service health before changing
configuration. 36. An administrator finds a configuration drift between two hosts; three
C. Disable security controls permanently to remove the symptom. consecutive health checks fail. Which action best distinguishes the underlying
D. Restart every dependent service before collecting any diagnostic evidence. cause from a symptom in disaster-recovery planning?
Correct Answer: B A. Disable security controls permanently to remove the symptom.
Explanation: This answer uses verified evidence before action, which reduces the chance B. Restart every dependent service before collecting any diagnostic evidence.
of masking the real problem and supports a traceable decision about Secure C. Compare the observed state with the intended configuration and preserve a rollback
configuration, hardening and vulnerability management. path, then confirm that the corrective action is effective before closure.
D. Apply an untested production change and rely on users to report whether it worked.
27. Users report intermittent access while core services remain online. A change Correct Answer: C
affecting Secure configuration is being considered. How should it be handled? Explanation: A defensible professional decision should be based on current evidence and
A. Apply the least-privilege fix and validate the affected service after the change. applicable criteria. The other choices rely on assumption, remove safeguards, or change
B. Assume the most recent change is the cause without checking logs or state. conditions before the cause is understood.
C. Erase or rotate the relevant logs before establishing the cause.
D. Make several unrelated changes at once so one of them is likely to work. 37. A recent change is suspected after application latency rises. Which response
Correct Answer: A is most consistent with the professional or compliance requirements governing
Explanation: The selected action best supports safe, compliant, and technically sound Third-party, supply-chain and compliance risk?
performance because it addresses Secure configuration using observable evidence rather A. Apply the least-privilege fix and validate the affected service after the change.
than convenience. B. Erase or rotate the relevant logs before establishing the cause.
C. Make several unrelated changes at once so one of them is likely to work.
28. A deployment succeeds on one node but fails on another; latency rises from 40
D. Assume the most recent change is the cause without checking logs or state.
ms to 420 ms. The abnormal condition directly affects vulnerability management. Correct Answer: A
What is the most appropriate response? Explanation: This is the most appropriate option because it connects the observed
A. Restart every dependent service before collecting any diagnostic evidence. condition to the governing requirement and leaves a record of why the decision was made.
B. Apply an untested production change and rely on users to report whether it worked.
C. Verify the current state with logs and service health before changing 38. A security review identifies an unexpected privilege path. Which handoff
configuration. practice best reduces error risk for compliance risk?
D. Disable security controls permanently to remove the symptom. A. Apply an untested production change and rely on users to report whether it worked.
Correct Answer: C B. Disable security controls permanently to remove the symptom.
Explanation: A defensible professional decision should be based on current evidence and C. Restart every dependent service before collecting any diagnostic evidence.
applicable criteria. The other choices rely on assumption, remove safeguards, or change D. Record the observed condition, supporting evidence, decision and responsible
conditions before the cause is understood. follow-up; communicate any unresolved risk to the next responsible person.
Correct Answer: D
29. An automation job reports partial success across the environment. Which
Explanation: The correct choice follows a verify-act-confirm sequence. That is more
documentation approach best supports traceability for Cloud, virtualization and reliable than bypassing controls or making multiple uncontrolled changes.
shared-responsibility security considerations?
A. Make several unrelated changes at once so one of them is likely to work.
B. Assume the most recent change is the cause without checking logs or state.
C. Erase or rotate the relevant logs before establishing the cause.
D. Record the observed condition, supporting evidence, decision and responsible
follow-up; communicate any unresolved risk to the next responsible person.
Correct Answer: D
Explanation: This is the most appropriate option because it connects the observed
condition to the governing requirement and leaves a record of why the decision was made.
2
, US Executive security role | Comprehensive Practice Exam Questions & Answers
39. A production service begins failing health checks. Which decision about 49. A server has an address but traffic uses the wrong route. Which documentation
Security assessment, testing and remediation prioritization is best supported by approach best supports traceability for Network security architecture,
the available evidence? segmentation and secure communications?
A. Assume the most recent change is the cause without checking logs or state. A. Restart all networked applications before verifying interface state.
B. Erase or rotate the relevant logs before establishing the cause. B. Add multiple default routes until connectivity returns.
C. Make several unrelated changes at once so one of them is likely to work. C. Record the observed condition, supporting evidence, decision and responsible
D. Apply the least-privilege fix and validate the affected service after the change. follow-up; communicate any unresolved risk to the next responsible person.
Correct Answer: D D. Change the hostname because dns lookup failed.
Explanation: The strongest exam-style response is the one that controls immediate risk, Correct Answer: C
checks the relevant condition, and then acts within the defined requirements for Explanation: This approach preserves control of the situation while producing evidence
Security assessment, testing and remediation prioritization. that can confirm whether the action actually corrected the issue involving Network
security architecture, segmentation and secure communications.
40. A security review identifies an unexpected privilege path; a service exits
twice within ten minutes. Which review step adds the most value before closing 50. A server has an address but traffic uses the wrong route. Which action is
work involving Security assessment? most likely to prevent recurrence of a problem involving Network security
A. Restart every dependent service before collecting any diagnostic evidence. architecture?
B. Apply an untested production change and rely on users to report whether it worked. A. Flush every firewall rule before checking the route.
C. Disable security controls permanently to remove the symptom. B. Compare the active connection profile with the intended persistent configuration
D. Compare the observed state with the intended configuration and preserve a rollback and test name resolution separately from ip reachability, then confirm that the
path, then confirm that the corrective action is effective before closure. corrective action is effective before closure.
Correct Answer: D C. Change the hostname because dns lookup failed.
Explanation: The correct response protects the integrity of the process: establish the D. Restart all networked applications before verifying interface state.
facts, apply the appropriate control, and verify the result before closure. Correct Answer: B
Explanation: This answer uses verified evidence before action, which reduces the chance
41. A recent change is suspected after application latency rises. With respect to of masking the real problem and supports a traceable decision about Network security
remediation prioritization, what is the best FIRST action? architecture.
A. Make several unrelated changes at once so one of them is likely to work.
B. Assume the most recent change is the cause without checking logs or state. 51. An automation job reports partial success across the environment. Which
C. Apply the least-privilege fix and validate the affected service after the change. sequence is most appropriate when carrying out secure communications?
D. Erase or rotate the relevant logs before establishing the cause. A. Assume the most recent change is the cause without checking logs or state.
Correct Answer: C B. Erase or rotate the relevant logs before establishing the cause.
Explanation: This approach preserves control of the situation while producing evidence C. Make several unrelated changes at once so one of them is likely to work.
that can confirm whether the action actually corrected the issue involving remediation D. Apply the least-privilege fix and validate the affected service after the change,
prioritization. then verify the resulting state before moving to the next step.
Correct Answer: D
42. A recent change is suspected after application latency rises. Which evidence Explanation: The selected action best supports safe, compliant, and technically sound
is most important when evaluating Security governance, risk management and policy performance because it addresses secure communications using observable evidence rather
implementation? than convenience.
A. Disable security controls permanently to remove the symptom.
B. Review service status, recent logs and dependency health and compare the findings 52. A deployment succeeds on one node but fails on another; latency rises from 40
with the applicable criteria. ms to 420 ms. Which choice demonstrates the strongest control of Cryptography,
C. Restart every dependent service before collecting any diagnostic evidence. key management and protection of data in transit and at rest?
D. Apply an untested production change and rely on users to report whether it worked. A. Restart every dependent service before collecting any diagnostic evidence.
Correct Answer: B B. Apply an untested production change and rely on users to report whether it worked.
Explanation: This answer uses verified evidence before action, which reduces the chance C. Disable security controls permanently to remove the symptom.
of masking the real problem and supports a traceable decision about Security governance, D. Verify the current state with logs and service health before changing
risk management and policy implementation. configuration.
Correct Answer: D
43. A recent change is suspected after application latency rises. Which response Explanation: A defensible professional decision should be based on current evidence and
best controls the primary risk associated with Security governance? applicable criteria. The other choices rely on assumption, remove safeguards, or change
A. Apply the least-privilege fix and validate the affected service after the change. conditions before the cause is understood.
B. Erase or rotate the relevant logs before establishing the cause.
C. Make several unrelated changes at once so one of them is likely to work. 53. A platform upgrade is planned for a business-critical workload. What is
D. Assume the most recent change is the cause without checking logs or state. required before accepting the result related to key management?
Correct Answer: A A. Make several unrelated changes at once so one of them is likely to work.
Explanation: The selected action best supports safe, compliant, and technically sound B. Assume the most recent change is the cause without checking logs or state.
performance because it addresses Security governance using observable evidence rather C. Review current policy enforcement and access-control denials and compare the
than convenience. findings with the applicable criteria.
D. Erase or rotate the relevant logs before establishing the cause.
44. An administrator finds a configuration drift between two hosts; three Correct Answer: C
consecutive health checks fail. Before proceeding with work involving risk Explanation: This is the most appropriate option because it connects the observed
management, what should be verified? condition to the governing requirement and leaves a record of why the decision was made.
A. Apply an untested production change and rely on users to report whether it worked.
B. Disable security controls permanently to remove the symptom. 54. A production service begins failing health checks. Under these conditions,
C. Restart every dependent service before collecting any diagnostic evidence. when should the issue involving protection of data in transit be escalated?
D. Review resource utilization, error logs and network reachability and compare the A. Disable security controls permanently to remove the symptom.
findings with the applicable criteria. B. Verify the current state with logs and service health before changing
Correct Answer: D configuration.
Explanation: A defensible professional decision should be based on current evidence and C. Restart every dependent service before collecting any diagnostic evidence.
applicable criteria. The other choices rely on assumption, remove safeguards, or change D. Apply an untested production change and rely on users to report whether it worked.
conditions before the cause is understood. Correct Answer: B
Explanation: The correct choice follows a verify-act-confirm sequence. That is more
45. An automation job reports partial success across the environment. Which reliable than bypassing controls or making multiple uncontrolled changes.
troubleshooting approach is most appropriate for policy implementation?
A. Assume the most recent change is the cause without checking logs or state. 55. A system must be recovered without losing the current audit trail. Which
B. Erase or rotate the relevant logs before establishing the cause. comparison is most useful for interpreting at rest?
C. Make several unrelated changes at once so one of them is likely to work. A. Erase or rotate the relevant logs before establishing the cause.
D. Apply the least-privilege fix and validate the affected service after the change. B. Make several unrelated changes at once so one of them is likely to work.
Correct Answer: D C. Review configuration history and a tested rollback point and compare the findings
Explanation: This is the most appropriate option because it connects the observed with the applicable criteria.
condition to the governing requirement and leaves a record of why the decision was made. D. Assume the most recent change is the cause without checking logs or state.
Correct Answer: C
46. A system must be recovered without losing the current audit trail. Which Explanation: The strongest exam-style response is the one that controls immediate risk,
action best supports a defensible decision about Identity and access management, checks the relevant condition, and then acts within the defined requirements for at
authentication and privileged access? rest.
A. Restart every dependent service before collecting any diagnostic evidence.
B. Apply an untested production change and rely on users to report whether it worked. 56. A platform upgrade is planned for a business-critical workload; a service
C. Disable security controls permanently to remove the symptom. exits twice within ten minutes. Which action best distinguishes the underlying
D. Verify the current state with logs and service health before changing cause from a symptom in Secure configuration, hardening and vulnerability
configuration. management?
Correct Answer: D A. Compare the observed state with the intended configuration and preserve a rollback
Explanation: The correct choice follows a verify-act-confirm sequence. That is more path, then confirm that the corrective action is effective before closure.
reliable than bypassing controls or making multiple uncontrolled changes. B. Apply an untested production change and rely on users to report whether it worked.
C. Disable security controls permanently to remove the symptom.
47. A production service begins failing health checks. A change affecting access D. Restart every dependent service before collecting any diagnostic evidence.
management is being considered. How should it be handled? Correct Answer: A
A. Apply the least-privilege fix and validate the affected service after the change. Explanation: The correct response protects the integrity of the process: establish the
B. Make several unrelated changes at once so one of them is likely to work. facts, apply the appropriate control, and verify the result before closure.
C. Assume the most recent change is the cause without checking logs or state.
D. Erase or rotate the relevant logs before establishing the cause. 57. Users report intermittent access while core services remain online. Which
Correct Answer: A response is most consistent with the professional or compliance requirements
Explanation: The strongest exam-style response is the one that controls immediate risk, governing Secure configuration?
checks the relevant condition, and then acts within the defined requirements for access A. Assume the most recent change is the cause without checking logs or state.
management. B. Erase or rotate the relevant logs before establishing the cause.
C. Apply the least-privilege fix and validate the affected service after the change.
48. An automation job reports partial success across the environment; CPU
D. Make several unrelated changes at once so one of them is likely to work.
utilization reaches 96%. The abnormal condition directly affects privileged Correct Answer: C
access. What is the most appropriate response? Explanation: This approach preserves control of the situation while producing evidence
A. Disable security controls permanently to remove the symptom. that can confirm whether the action actually corrected the issue involving Secure
B. Verify the current state with logs and service health before changing configuration.
configuration.
C. Restart every dependent service before collecting any diagnostic evidence.
D. Apply an untested production change and rely on users to report whether it worked.
Correct Answer: B
Explanation: The correct response protects the integrity of the process: establish the
facts, apply the appropriate control, and verify the result before closure.
3
