Question 470
A privileged service account starts downloading records at unusual times from new devices. Which response best addresses the central security requirement with a defensible, risk-based design?
- Investigate behavioral deviation with context and confirm whether the activity is authorized
- Treat a single anomaly score as conclusive guilt
- Ignore deviations whenever credentials authenticate successfully
- Monitor network flows, DNS, TLS metadata and behavioral indicators at appropriate capture points
Explanation
Correct Answer
A:Behavior analytics provides anomaly indications, not automatic proof of compromise.
Incorrect Answers
B:Legitimate change can create anomalies.
C:Valid credentials may be stolen.
D:Network detection can identify anomalous communications without decrypting every payload. Investigate behavioral deviation with context and confirm whether the activity is authorized.
Question 471
Encrypted command-and-control traffic hides payload content but its destination and timing are suspicious. Which response best addresses the central security requirement with a defensible, risk-based design?
- Monitor network flows, DNS, TLS metadata and behavioral indicators at appropriate capture points
- Investigate behavioral deviation with context and confirm whether the activity is authorized
- Assume a perimeter firewall proves internal lateral movement cannot occur
- Disable traffic metadata collection because application content is encrypted
Explanation
Correct Answer
A:Network detection can identify anomalous communications without decrypting every payload.
Incorrect Answers
B:Behavior analytics provides anomaly indications, not automatic proof of compromise. Monitor network flows, DNS, TLS metadata and behavioral indicators at appropriate capture points.
C:East-west paths require their own observability.
D:Flow information remains useful even with encryption.
Question 472
A workstation repeatedly contacts an unapproved external cloud-storage endpoint. Which response best addresses the central security requirement with a defensible, risk-based design?
- Apply controlled outbound policy and investigate actual data-flow intent and approved exceptions
- Permit all TLS destinations because encryption guarantees authorized use
- Set a documented retention architecture with tamper protection, accessible archive and controlled deletion
- Block only unsolicited inbound connections
Explanation
Correct Answer
A:Egress governance reduces exfiltration paths while preserving business connectivity.
Incorrect Answers
B:TLS protects transport, not destination legitimacy.
C:Retention must satisfy legal and investigation access requirements. Apply controlled outbound policy and investigate actual data-flow intent and approved exceptions.
D:Exfiltration often uses outbound sessions.
Question 473
Analysts import external indicator feeds with thousands of stale IP addresses into automatic blocking. Which response best addresses the central security requirement with a defensible, risk-based design?
- Apply controlled outbound policy and investigate actual data-flow intent and approved exceptions
- Block every indicator forever with no review
- Score indicators for confidence, relevance, age and false-positive impact before enforcement
- Base prioritization only on feed volume
Explanation
Correct Answer
C:Threat intelligence should be contextualized and actioned proportionately.
Incorrect Answers
A:Egress governance reduces exfiltration paths while preserving business connectivity. Score indicators for confidence, relevance, age and false-positive impact before enforcement.
B:Indicators decay and shared infrastructure can be legitimate.
D:Quantity does not measure fidelity or applicability.
Question 474
A regulator needs six months of audit evidence but the SIEM deletes searchable events after seven days. Which response best addresses the central security requirement with a defensible, risk-based design?
- Keep every event forever in the most expensive hot tier
- Turn off logs when the hot tier is full
- Set a documented retention architecture with tamper protection, accessible archive and controlled deletion
- Normalize and correlate events using synchronized timestamps and relevant entity identifiers
Explanation
Correct Answer
C:Retention must satisfy legal and investigation access requirements.
Incorrect Answers
A:Indefinite retention may violate policy and inflate cost.
B:Dropped events break audit coverage.
D:A SIEM can connect otherwise fragmented events when ingestion quality is controlled. Set a documented retention architecture with tamper protection, accessible archive and controlled deletion.
Question 475
After a prior siem finding, a manufacturing enterprise reports that the approved safeguard is implemented: “Normalize and correlate events using synchronized timestamps and relevant entity identifiers.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Accept a signed change ticket saying: Normalize and correlate events using synchronized timestamps and relevant entity identifiers
- Use the completion of this alternative as proof: Increase only firewall storage without correlating identity events
- Replay a known multi-source incident and confirm linked events form the expected timeline
- Run this adjacent but different test as the sole proof: Attempt a blocked outbound path and an approved business path and verify both outcomes
Explanation
Correct Answer
C:Correlation replay directly validates useful alert context.
Incorrect Answers
A:Replay a known multi-source incident and confirm linked events form the expected timeline. Correlation replay directly validates useful alert context.
B:More isolated logs do not supply attack context. Replay a known multi-source incident and confirm linked events form the expected timeline.
D:Positive and negative tests show egress enforcement without unnecessary outage. It tests egress, while this case requires evidence about siem.
Question 476
After a prior ueba finding, an international retailer reports that the approved safeguard is implemented: “Investigate behavioral deviation with context and confirm whether the activity is authorized.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Simulate a permitted test beacon and confirm the NDR sensor records its flow and context
- Accept a signed change ticket saying: Investigate behavioral deviation with context and confirm whether the activity is authorized
- Use the completion of this alternative as proof: Treat a single anomaly score as conclusive guilt
- Assess false positives and confirmed detections using representative normal and malicious activity
Explanation
Correct Answer
D:Model quality depends on detection and business-context validation.
Incorrect Answers
A:Test visibility shows placement and analytics cover the relevant segment. It tests ndr, while this case requires evidence about ueba.
B:Assess false positives and confirmed detections using representative normal and malicious activity. Model quality depends on detection and business-context validation.
C:Legitimate change can create anomalies. Assess false positives and confirmed detections using representative normal and malicious activity.
Question 477
After a prior ndr finding, a university consortium reports that the approved safeguard is implemented: “Monitor network flows, DNS, TLS metadata and behavioral indicators at appropriate capture points.” The assurance team must decide whether this measure demonstrably works in operation. Which evidence would MOST directly establish its effectiveness?
- Run this adjacent but different test as the sole proof: Assess false positives and confirmed detections using representative normal and malicious activity
- Simulate a permitted test beacon and confirm the NDR sensor records its flow and context
- Accept a signed change ticket saying: Monitor network flows, DNS, TLS metadata and behavioral indicators at appropriate capture points
- Use the completion of this alternative as proof: Disable traffic metadata collection because application content is encrypted
Explanation
Correct Answer
B:Test visibility shows placement and analytics cover the relevant segment.
Incorrect Answers
A:Model quality depends on detection and business-context validation. It tests ueba, while this case requires evidence about ndr.
C:Simulate a permitted test beacon and confirm the NDR sensor records its flow and context. Test visibility shows placement and analytics cover the relevant segment.
D:Flow information remains useful even with encryption. Simulate a permitted test beacon and confirm the NDR sensor records its flow and context.
Question 478
Teams cannot tell which firewall rule changes were approved on production devices. Which response best addresses the central security requirement with a defensible, risk-based design?
- Use the last administrator's memory as the approved baseline
- Replace every device with its vendor factory defaults
- Use controlled configuration-as-code with approvals, idempotent deployment and rollback
- Maintain a versioned, owner-approved secure configuration baseline for each device class
Explanation
Correct Answer
D:Baselines provide the reference for controlled change and compliance.
Incorrect Answers
A:Informal recollection is unverifiable.
B:Factory defaults may weaken required security.
C:Automation reduces inconsistent application while retaining traceability. Maintain a versioned, owner-approved secure configuration baseline for each device class.
Question 479
Hundreds of servers miss recurring hardening steps when operators use manual runbooks. Which response best addresses the central security requirement with a defensible, risk-based design?
- Run unreviewed scripts directly as root across all servers
- Use controlled configuration-as-code with approvals, idempotent deployment and rollback
- Disable all validation to speed fleet convergence
- Maintain a versioned, owner-approved secure configuration baseline for each device class
Explanation
Correct Answer
B:Automation reduces inconsistent application while retaining traceability.
Incorrect Answers
A:Uncontrolled automation magnifies defects.
C:Fast erroneous deployment is not a secure baseline.
D:Baselines provide the reference for controlled change and compliance. Use controlled configuration-as-code with approvals, idempotent deployment and rollback.
Question 480
A production Kubernetes cluster has progressively gained broad administrative bindings not present in its approved manifests. Which response best addresses the central security requirement with a defensible, risk-based design?
- Detect and reconcile actual roles against a version-controlled approved configuration
- Delete every workload whenever drift appears without investigating cause
- Allow manual bindings to override Git indefinitely
- Maintain a versioned, owner-approved secure configuration baseline for each device class
Explanation
Correct Answer
A:Drift can increase privilege even without a planned change.
Incorrect Answers
B:Disruption may be excessive and hide root cause.
C:Untracked permissions remain effective.
D:Baselines provide the reference for controlled change and compliance. Detect and reconcile actual roles against a version-controlled approved configuration.
Certified Information Systems Security Professional (CISSP) Practice Tests