Exam Bundle

The investigation maps the suspicious flow to a device and application without exposing protected payloads. This would be relevant evidence for a different failure: An incident response team sees encrypted traffic but cannot identify the affected application or host, usually addressed by Correlate encrypted-flow metadata with endpoint identity, DNS, and allowed TLS telemetry. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: A time-bounded capture corroborates the protocol sequence without indiscriminate traffic retention.

A seeded unauthorized lateral path is highlighted with both endpoints and baseline variance. This would be relevant evidence for a different failure: Security dashboards show average packet rates but not anomalous lateral movement by a compromised workload, usually addressed by Baseline internal east-west flows and alert on new or unusual connection relationships. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: A time-bounded capture corroborates the protocol sequence without indiscriminate traffic retention.

An anomalous outbound connection pattern is visible as aggregated network flow evidence. This would be relevant evidence for a different failure: A SOC needs to correlate high-volume connection behavior but collects only periodic interface counters, usually addressed by Enable appropriate flow records and analyze source, destination, ports, timestamps, and volume. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: A time-bounded capture corroborates the protocol sequence without indiscriminate traffic retention.

Collect targeted packet captures at an authorized observation point with privacy safeguards. That action fits another problem: An incident investigation can see host logs but has no network packet context for a disputed event. It does not directly remediate the current finding at Trident Finance: Security dashboards show average packet rates but not anomalous lateral movement by a compromised workload. The relevant corrective control for this case is: Baseline internal east-west flows and alert on new or unusual connection relationships.

Enable appropriate flow records and analyze source, destination, ports, timestamps, and volume. That action fits another problem: A SOC needs to correlate high-volume connection behavior but collects only periodic interface counters. It does not directly remediate the current finding at Trident Finance: Security dashboards show average packet rates but not anomalous lateral movement by a compromised workload. The relevant corrective control for this case is: Baseline internal east-west flows and alert on new or unusual connection relationships.

Deduplicate and aggregate detections by entity and time while preserving raw evidence. That action fits another problem: A SIEM correlation rule raises thousands of identical alerts for a single blocked scanner. It does not directly remediate the current finding at Trident Finance: Security dashboards show average packet rates but not anomalous lateral movement by a compromised workload. The relevant corrective control for this case is: Baseline internal east-west flows and alert on new or unusual connection relationships.

A time-bounded capture corroborates the protocol sequence without indiscriminate traffic retention. This would be relevant evidence for a different failure: An incident investigation can see host logs but has no network packet context for a disputed event, usually addressed by Collect targeted packet captures at an authorized observation point with privacy safeguards. It does not demonstrate that the current problem at Trident Finance was resolved. The specific required evidence is: A seeded unauthorized lateral path is highlighted with both endpoints and baseline variance.

One actionable incident links the underlying repeated events without losing forensic details. This would be relevant evidence for a different failure: A SIEM correlation rule raises thousands of identical alerts for a single blocked scanner, usually addressed by Deduplicate and aggregate detections by entity and time while preserving raw evidence. It does not demonstrate that the current problem at Trident Finance was resolved. The specific required evidence is: A seeded unauthorized lateral path is highlighted with both endpoints and baseline variance.

An anomalous outbound connection pattern is visible as aggregated network flow evidence. This would be relevant evidence for a different failure: A SOC needs to correlate high-volume connection behavior but collects only periodic interface counters, usually addressed by Enable appropriate flow records and analyze source, destination, ports, timestamps, and volume. It does not demonstrate that the current problem at Trident Finance was resolved. The specific required evidence is: A seeded unauthorized lateral path is highlighted with both endpoints and baseline variance.

Enable appropriate flow records and analyze source, destination, ports, timestamps, and volume. That action fits another problem: A SOC needs to correlate high-volume connection behavior but collects only periodic interface counters. It does not directly remediate the current finding at Seabright Municipal Works: Security dashboards show average packet rates but not anomalous lateral movement by a compromised workload. The relevant corrective control for this case is: Baseline internal east-west flows and alert on new or unusual connection relationships.

Correlate encrypted-flow metadata with endpoint identity, DNS, and allowed TLS telemetry. That action fits another problem: An incident response team sees encrypted traffic but cannot identify the affected application or host. It does not directly remediate the current finding at Seabright Municipal Works: Security dashboards show average packet rates but not anomalous lateral movement by a compromised workload. The relevant corrective control for this case is: Baseline internal east-west flows and alert on new or unusual connection relationships.

Synchronize clocks using authenticated NTP and capture normalized timestamps centrally. That action fits another problem: Several security devices record events with unrelated local clocks, preventing reliable timeline reconstruction. It does not directly remediate the current finding at Seabright Municipal Works: Security dashboards show average packet rates but not anomalous lateral movement by a compromised workload. The relevant corrective control for this case is: Baseline internal east-west flows and alert on new or unusual connection relationships.

The investigation maps the suspicious flow to a device and application without exposing protected payloads. This would be relevant evidence for a different failure: An incident response team sees encrypted traffic but cannot identify the affected application or host, usually addressed by Correlate encrypted-flow metadata with endpoint identity, DNS, and allowed TLS telemetry. It does not demonstrate that the current problem at Seabright Municipal Works was resolved. The specific required evidence is: A seeded unauthorized lateral path is highlighted with both endpoints and baseline variance.

An anomalous outbound connection pattern is visible as aggregated network flow evidence. This would be relevant evidence for a different failure: A SOC needs to correlate high-volume connection behavior but collects only periodic interface counters, usually addressed by Enable appropriate flow records and analyze source, destination, ports, timestamps, and volume. It does not demonstrate that the current problem at Seabright Municipal Works was resolved. The specific required evidence is: A seeded unauthorized lateral path is highlighted with both endpoints and baseline variance.

Events from multiple devices order correctly within defined clock tolerance. This would be relevant evidence for a different failure: Several security devices record events with unrelated local clocks, preventing reliable timeline reconstruction, usually addressed by Synchronize clocks using authenticated NTP and capture normalized timestamps centrally. It does not demonstrate that the current problem at Seabright Municipal Works was resolved. The specific required evidence is: A seeded unauthorized lateral path is highlighted with both endpoints and baseline variance.

Enable Dynamic ARP Inspection with appropriate trusted ports and binding validation. That action fits another problem: Hosts experience ARP spoofing on a VLAN that already has a valid DHCP snooping database. It does not directly remediate the current finding at Prairie Health Network: A campus switch accepts DHCP offers from an untrusted workstation acting as a rogue server. The relevant corrective control for this case is: Enable DHCP snooping and mark only the legitimate DHCP uplinks as trusted.

Configure port-security limits and a suitable violation response on untrusted edge ports. That action fits another problem: An access port accepts many spoofed source MAC addresses and exhausts switch forwarding entries. It does not directly remediate the current finding at Prairie Health Network: A campus switch accepts DHCP offers from an untrusted workstation acting as a rogue server. The relevant corrective control for this case is: Enable DHCP snooping and mark only the legitimate DHCP uplinks as trusted.

Define SGT classification and enforce appropriate SGACL policy at supported points. That action fits another problem: A campus uses security group tags but enforcement devices accept traffic without matching identity-based contracts. It does not directly remediate the current finding at Prairie Health Network: A campus switch accepts DHCP offers from an untrusted workstation acting as a rogue server. The relevant corrective control for this case is: Enable DHCP snooping and mark only the legitimate DHCP uplinks as trusted.

Spoofed ARP replies are blocked while bindings from legitimate hosts are accepted. This would be relevant evidence for a different failure: Hosts experience ARP spoofing on a VLAN that already has a valid DHCP snooping database, usually addressed by Enable Dynamic ARP Inspection with appropriate trusted ports and binding validation. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: A rogue offer on an access port is discarded and genuine clients obtain correct leases.

A restricted tag-to-tag connection is denied and an allowed application flow succeeds. This would be relevant evidence for a different failure: A campus uses security group tags but enforcement devices accept traffic without matching identity-based contracts, usually addressed by Define SGT classification and enforce appropriate SGACL policy at supported points. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: A rogue offer on an access port is discarded and genuine clients obtain correct leases.

Excess learned addresses trigger the configured action without impacting approved devices. This would be relevant evidence for a different failure: An access port accepts many spoofed source MAC addresses and exhausts switch forwarding entries, usually addressed by Configure port-security limits and a suitable violation response on untrusted edge ports. It does not demonstrate that the current problem at Prairie Health Network was resolved. The specific required evidence is: A rogue offer on an access port is discarded and genuine clients obtain correct leases.

Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene. That action fits another problem: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack. It does not directly remediate the current finding at Boreal Foods: A campus switch accepts DHCP offers from an untrusted workstation acting as a rogue server. The relevant corrective control for this case is: Enable DHCP snooping and mark only the legitimate DHCP uplinks as trusted.

Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles. That action fits another problem: A loop-inducing switch appears on an edge port and influences spanning-tree topology. It does not directly remediate the current finding at Boreal Foods: A campus switch accepts DHCP offers from an untrusted workstation acting as a rogue server. The relevant corrective control for this case is: Enable DHCP snooping and mark only the legitimate DHCP uplinks as trusted.

Configure port-security limits and a suitable violation response on untrusted edge ports. That action fits another problem: An access port accepts many spoofed source MAC addresses and exhausts switch forwarding entries. It does not directly remediate the current finding at Boreal Foods: A campus switch accepts DHCP offers from an untrusted workstation acting as a rogue server. The relevant corrective control for this case is: Enable DHCP snooping and mark only the legitimate DHCP uplinks as trusted.

Excess learned addresses trigger the configured action without impacting approved devices. This would be relevant evidence for a different failure: An access port accepts many spoofed source MAC addresses and exhausts switch forwarding entries, usually addressed by Configure port-security limits and a suitable violation response on untrusted edge ports. It does not demonstrate that the current problem at Boreal Foods was resolved. The specific required evidence is: A rogue offer on an access port is discarded and genuine clients obtain correct leases.

A crafted trunk-negotiation attempt cannot create an unauthorized trunk. This would be relevant evidence for a different failure: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack, usually addressed by Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene. It does not demonstrate that the current problem at Boreal Foods was resolved. The specific required evidence is: A rogue offer on an access port is discarded and genuine clients obtain correct leases.

Unexpected BPDUs disable the offending edge port without changing the protected root. This would be relevant evidence for a different failure: A loop-inducing switch appears on an edge port and influences spanning-tree topology, usually addressed by Enable BPDU Guard on appropriate PortFast edge ports and protect designated root roles. It does not demonstrate that the current problem at Boreal Foods was resolved. The specific required evidence is: A rogue offer on an access port is discarded and genuine clients obtain correct leases.

Configure port-security limits and a suitable violation response on untrusted edge ports. That action fits another problem: An access port accepts many spoofed source MAC addresses and exhausts switch forwarding entries. It does not directly remediate the current finding at Willowbrook Education: Hosts experience ARP spoofing on a VLAN that already has a valid DHCP snooping database. The relevant corrective control for this case is: Enable Dynamic ARP Inspection with appropriate trusted ports and binding validation.

Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene. That action fits another problem: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack. It does not directly remediate the current finding at Willowbrook Education: Hosts experience ARP spoofing on a VLAN that already has a valid DHCP snooping database. The relevant corrective control for this case is: Enable Dynamic ARP Inspection with appropriate trusted ports and binding validation.

Enable DHCP snooping and mark only the legitimate DHCP uplinks as trusted. That action fits another problem: A campus switch accepts DHCP offers from an untrusted workstation acting as a rogue server. It does not directly remediate the current finding at Willowbrook Education: Hosts experience ARP spoofing on a VLAN that already has a valid DHCP snooping database. The relevant corrective control for this case is: Enable Dynamic ARP Inspection with appropriate trusted ports and binding validation.

Excess learned addresses trigger the configured action without impacting approved devices. This would be relevant evidence for a different failure: An access port accepts many spoofed source MAC addresses and exhausts switch forwarding entries, usually addressed by Configure port-security limits and a suitable violation response on untrusted edge ports. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: Spoofed ARP replies are blocked while bindings from legitimate hosts are accepted.

A crafted trunk-negotiation attempt cannot create an unauthorized trunk. This would be relevant evidence for a different failure: A user can hop into another VLAN through unintended DTP trunk negotiation on a wall jack, usually addressed by Disable automatic trunk negotiation and enforce a fixed access VLAN and unused native VLAN hygiene. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: Spoofed ARP replies are blocked while bindings from legitimate hosts are accepted.

A rogue offer on an access port is discarded and genuine clients obtain correct leases. This would be relevant evidence for a different failure: A campus switch accepts DHCP offers from an untrusted workstation acting as a rogue server, usually addressed by Enable DHCP snooping and mark only the legitimate DHCP uplinks as trusted. It does not demonstrate that the current problem at Willowbrook Education was resolved. The specific required evidence is: Spoofed ARP replies are blocked while bindings from legitimate hosts are accepted.