Mock Exam Part 3: Operations, Incident Response, and Forensics

Welcome to Mock Exam Part 3, the most heavily tested domain: Security Operations (Domain 4, 28%). This domain covers what security professionals do daily — managing identities, securing endpoints, monitoring networks, responding to incidents, and conducting forensic investigations. Questions here are heavily scenario-based, testing your ability to choose the right action given a specific situation. This section also samples Domain 5 (Security Program Management, 20%) which covers risk management, compliance, and governance. Together these domains represent 48% of your exam score — nearly half.

Question: A security analyst confirms that a workstation is actively communicating with a known botnet C2 server. The analyst isolates the workstation from the network. What IR phase does this action fall under?

Answer: Containment. The NIST SP 800-61 IR phases and their primary actions: Preparation — building IR plans and teams; Detection and Analysis — confirming the incident occurred (the analyst has already done this by confirming C2 communication); Containment — limiting the damage (network isolation is a containment action); Eradication — removing the malware; Recovery — restoring systems to operational state; Post-Incident Review — lessons learned. Network isolation (disconnecting, blocking firewall rules) is the quintessential containment action — it stops the attacker from using the compromised host while investigation continues.

Question: An organization's traditional antivirus consistently misses malware that uses PowerShell to execute code entirely in memory without dropping files. What security technology BEST addresses this gap?

Answer: Endpoint Detection and Response (EDR). Traditional antivirus uses file signature matching — it scans files and compares them against a database of known malware signatures. Fileless malware that runs entirely in memory never writes a file, so signature-based AV never scans the malicious code. EDR uses behavioral detection — monitoring process behavior (memory access patterns, API calls, PowerShell script block logging, network connections) regardless of whether a file exists. EDR can detect that PowerShell is behaving anomalously (downloading and executing code, accessing LSASS) even without a signature. EDR also provides response capabilities — isolating endpoints, killing processes, collecting forensic evidence.

Question: An employee transfers from the Finance department to the Marketing department. Security policy requires that their access to Finance systems be removed and Marketing access be provisioned. What process ensures this happens correctly?

Answer: Identity lifecycle management / user provisioning and de-provisioning process. The risk being addressed is access creep — accumulating permissions from multiple roles over time. When an employee changes roles, their old access should be removed (de-provisioned) and new access granted. Without this process, the transferred employee retains both Finance and Marketing access, violating least privilege. This is managed through an Identity Governance and Administration (IGA) system, often automated via HR system integration. Access reviews/recertification campaigns periodically review all user access rights to catch accumulated privileges that were never revoked.

Question: A forensic investigator creates a disk image from a seized server. They use MD5 and SHA-256 hash values before and after imaging. What is the purpose of comparing these hash values?

Answer: To verify that the disk image is an exact, unmodified copy of the original evidence (proving integrity). In digital forensics, hash verification is how investigators prove they did not modify the evidence during the imaging process. A hash of the original disk is computed before imaging; after imaging, the hash of the resulting image is computed. If both hashes match, the image is a bit-for-bit exact copy. Any difference in the image would produce a different hash. This supports chain of custody and makes findings legally admissible. Both MD5 and SHA-256 are used together — MD5 is fast but has known collisions, SHA-256 provides collision resistance. Using both provides redundancy.

Question: A security operations center (SOC) needs to correlate login events from Active Directory, network connections from a firewall, and email events from an email gateway to identify accounts involved in data exfiltration. Which tool provides this cross-source correlation capability?

Answer: Security Information and Event Management (SIEM). A SIEM aggregates logs from multiple sources (Active Directory, firewalls, email gateways, EDR, cloud platforms), normalizes them into a common schema, and applies correlation rules that detect patterns spanning multiple sources. A single AD logon event is not meaningful; combined with outbound data transfers at the same time to a new external domain, it becomes an alert worth investigating. SIEM also provides: centralized log storage for forensic investigation, dashboards for SOC situational awareness, and alerting on threshold violations. SOAR (Security Orchestration, Automation, and Response) automates response actions triggered by SIEM alerts.

Question: A vulnerability scanner identifies 500 vulnerabilities across the organization's systems. The security team has limited resources. How should they prioritize remediation?

Answer: Prioritize by CVSS score combined with asset criticality and exploitability context (threat intelligence). Raw CVSS scores are a starting point, but effective prioritization requires combining them with: asset criticality — a Critical CVSS vulnerability on a non-critical test server is less urgent than a Medium vulnerability on the system processing credit card data; exploitability — is a working exploit publicly available? Active exploitation in the wild elevates priority dramatically; exposure — internet-facing vulnerabilities are higher priority than internal-only; and compensating controls — a firewall rule may partially mitigate a vulnerability on a system that cannot be immediately patched. EPSS (Exploit Prediction Scoring System) provides probability estimates of exploitation in the wild to complement CVSS.

Question: Employees use personal smartphones to access corporate email. The company wants to ensure that if an employee leaves or loses their phone, corporate data can be removed without affecting personal data. What MDM capability achieves this?

Answer: Selective wipe (containerization with selective wipe capability). Selective wipe removes only the corporate data container from a BYOD device, leaving personal data (photos, messages, apps) intact. This contrasts with a full remote wipe (factory reset — erases everything including personal data, which may be legally problematic on employee-owned devices). Modern MDM solutions (Intune, Jamf) use containerization — corporate apps and data live in a secured, encrypted container separate from personal content. When the container is selectively wiped, corporate data is removed without touching personal content. This is the legally and practically appropriate approach for BYOD scenarios.

Question: A company's payroll server is valued at $500,000. A ransomware attack has a 20% probability of occurring each year (ARO = 0.2) and would result in 50% data loss and 2-week downtime (Exposure Factor = 0.5). The proposed backup solution costs $15,000/year and would reduce EF to 0.10. Is the backup solution cost-effective?

Answer: Yes — current ALE is $50,000/year; with backup the new ALE is $10,000/year, saving $40,000/year against a $15,000 investment. Calculation: Current SLE = $500,000 × 0.5 = $250,000. Current ALE = $250,000 × 0.2 = $50,000/year. With backup: New SLE = $500,000 × 0.10 = $50,000. New ALE = $50,000 × 0.2 = $10,000/year. ALE reduction = $50,000 - $10,000 = $40,000. Cost of control = $15,000. Net annual benefit = $40,000 - $15,000 = $25,000/year — clearly cost-effective. This calculation (SLE × ARO = ALE) is a high-frequency Security+ topic.

Q9 — Account Offboarding: A sysadmin's account and shared credentials remain active after termination; systems are breached six months later. Answer: Immediate account de-provisioning and privileged credential rotation upon termination. The orphaned privileged account is the textbook failure. Offboarding must include: disable account immediately, rotate all shared credentials the person knew, audit service accounts they administered. LAPS helps with local admin; PAM solutions vault privileged credentials.

Q10 — Windows Forensic Artifacts: Investigator needs to determine which programs ran on a Windows system and when. Answer: Prefetch files (C:\Windows\Prefetch\*.pf) — record executable name, last run time, run count, and accessed files. Even if malware is deleted, its prefetch file may remain. Other key artifacts: Registry Run keys (persistence), Security Event Log (logon events 4624/4625/4648), LNK files (recent files), ShimCache (tracks all executions even without prefetch).

Separation of duties: No single person controls a complete critical process — prevents fraud. Mandatory vacation: Insider threats discovered by coverage employees. Job rotation: Prevents long-term fraud schemes; cross-trains staff. SOC playbook: Step-by-step IR procedure for specific incident types. Tabletop exercise: Simulated scenario discussion without executing technical steps — validates IR plan logic. GDPR right to erasure: Delete personal data upon request when no legal basis for retention. PCI-DSS scope reduction: Segment the cardholder data environment to reduce systems in scope. BIA (Business Impact Analysis): Identifies critical functions and establishes RTO/RPO requirements. Vendor due diligence: Assess supplier security before granting data access; require SOC 2/ISO 27001. STIX/TAXII: Machine-readable threat intelligence sharing format/protocol. Canary token: Decoy resource that alerts when accessed — signals active attacker presence. Continuous monitoring (NIST RMF): Ongoing dynamic assessment, not point-in-time — informs real-time risk decisions.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this mock exam part you reviewed: IR phase mapping — confirming that network isolation is a containment action, not eradication or detection, forensic evidence priority — RAM must be captured before disk imaging because of its volatility, and risk calculation with ALE — the formula SLE × ARO = ALE provides objective cost-benefit analysis for security controls. These operational concepts represent the heaviest-weighted domain on the Security+ exam. Next up is the final lesson: Mock Exam Review with scoring analysis and your personalized study plan.