4.0 · 28% of the exam

Security Operations

The largest domain. Identity, scanning, correlation, and the first move in an incident. Section exams live here and in Threats.

• 4.6 · FoundationalProduction deploys require one engineer to propose the change and a second engineer to approve it. Neither can complete the deploy alone. Which principle is this?
• 4.3 · AppliedAn unauthenticated scan of a server shows almost no missing patches. A scan that logs in with a read-only agent account shows 30. Why does the second scan disagree?
• 4.4 · AppliedThree logs arrive in ten minutes: VPN failures for one user, then a VPN success, then a large download from a file server that user rarely touches. A single rule fires only when all three occur together. What is that rule doing?
• 4.6 · ScenarioAttackers are relaying one-time codes from your SMS logins in real time, and a few employees have had SIM swaps. Which replacement is phishing-resistant?
• 4.8 · ScenarioRansomware is confirmed on one workstation. The share it was encrypting has been disconnected by a user who noticed. What is the next response action?
• 4.9 · ScenarioA USB drive found in the parking lot may become evidence. Which handling keeps it useful in an investigation?